dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
42s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe
Size 25.9MB
Sample240617-e7s6waydqq
SHA256 dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714
MD5 b6c8ad2f49e3fe9eba546ab1d18bc2f7
SHA1 2360ab7f803088b920b2dd520ca83183c35593ae
SHA512 b523cc1a026fae65b32243305dec86f419e6eae4f78f1178ebff43c56f6c208394fd26c63acc4591a61bdbc5f9f564cf5b4dd9998faa1a67c8c99e392444ff11
SSDEEP 786432:z2wmTDE+Q/AmzNU6hR6r3ATesWO0SMiVP13:KwmTDEgmzNJ/8O0SzPx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2540	4624	b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe	82
PID 4624 wrote to memory of 2540	4624	b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {1ec14616-f36a-4387-8d3a-63d7c1198de5} -a "百度杀毒" -v "百度在线网络技术（北京）有限公司" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 866301 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe"
  2⤵
  PID:2540