e8ab971471d6c0d18301ca917f88bbad44290778b1619788ead3e388497fecef

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 06:28

Target

b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe
Size

29.7MB
MD5

b2204cd1565f212db4ffef989250ac7a
SHA1

2b797f95c09b017c8c350f9bc9d796973dff896a
SHA256

e8ab971471d6c0d18301ca917f88bbad44290778b1619788ead3e388497fecef
SHA512

800f47634809e3768bb7b343a2279c7e01c346a5a5f6045b814521d2107c146827b3786485a26fe3fca05bac37777f8d66dee0ecee17b7a2be5a4d9c4a9037f1
SSDEEP

786432:edocvtSue66DPAxsKOUEjEl4cc8ThRRKt:eacvtSnRDPAxsa5g8ThKt

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
620	b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 620	2324	b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe	84
PID 2324 wrote to memory of 620	2324	b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe	84
PID 2324 wrote to memory of 620	2324	b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\is-IRS9F.tmp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IRS9F.tmp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.tmp" /SL5="$1200B2,30854229,58368,C:\Users\Admin\AppData\Local\Temp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:620

C:\Users\Admin\AppData\Local\Temp\is-IRS9F.tmp\b2204cd1565f212db4ffef989250ac7a_JaffaCakes118.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/620-6-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/620-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2324-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2324-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/2324-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download