f174c75e893120dc5a523f21cdd0165a6fc2f57756b849251c210f8862c11e6e

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 02:21

Target

0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe
Size

4.1MB
MD5

0c088808a6301c6202efb0c381aacdd2
SHA1

464a1cead44b7718f4794440157e836fae3d30e6
SHA256

f174c75e893120dc5a523f21cdd0165a6fc2f57756b849251c210f8862c11e6e
SHA512

eb40180b594cc4728274168412a3625c2961a1cc66564a8c48cf17846e8f3f7a9ea0bc706e4e768e5821f7d00188720c056fb1ba16562c83f42040694000bf3e
SSDEEP

98304:uXG6tECiGldPCPKtw0pA5OSPk0k+1tNo3+g6KCjmTpAQst:L6yCPna00OVr+1tNoQQTpYt

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4648	0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4648	4880	0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe	83
PID 4880 wrote to memory of 4648	4880	0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe	83
PID 4880 wrote to memory of 4648	4880	0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\is-MHPBQ.tmp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MHPBQ.tmp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.tmp" /SL5="$B00E0,4034558,53248,C:\Users\Admin\AppData\Local\Temp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4648

C:\Users\Admin\AppData\Local\Temp\is-MHPBQ.tmp\0c088808a6301c6202efb0c381aacdd2_JaffaCakes118.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
memory/4648-7-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4648-8-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4880-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4880-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4880-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download