cf9d0766e7ad9a7f3742344106c9d6560525ff4a48e2f274ff20f50f42e96888

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 06:25

Target

0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe
Size

124KB
MD5

0d04282c77bf09fc97ccf2daa1812283
SHA1

27d26613b53e8ac940a57940aaffe939927ec964
SHA256

cf9d0766e7ad9a7f3742344106c9d6560525ff4a48e2f274ff20f50f42e96888
SHA512

250cad2d7046c4ec86f48d2ce1ca044d1767733bdd6c901cba694907bffca931131b87bbe5ffa741ec68edb914466cd92999691ace38329240d5a8b2e0d3c756
SSDEEP

3072:4/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSXL:ztzsb5Uh28+V1WW69B9VjMdxPedN9ugj

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4616	1328	0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe	81
PID 1328 wrote to memory of 4616	1328	0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5FA4.tmp\5FA5.tmp\5FA6.bat C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe"
  2⤵
  PID:4616

C:\Users\Admin\AppData\Local\Temp\5FA4.tmp\5FA5.tmp\5FA6.bat

Filesize
134B

MD5
5b777d29ef9b201a444d778126b092df

SHA1
946db6e3e0b5ceb61f39aaafa83609c1e84bdcf5

SHA256
2573648589e8f4a7feb84007817575494b534c5f8762335fed8d48aea55ddef9

SHA512
c8dafb7c412b3d67e51c0a8f5540b0cabc28a63062c2aa9c0bb2c963a57b8e4a77539d958b2a9497078d1cee3b7c574cf0dd31390e9a0cc00b96c49dad0f3fd3

Download Submit