8f966abbdae0232750fc6bc15ef89427d614b11723ee98d422a856feff7af042

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 22:37

Target

17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe
Size

15KB
MD5

17c9376f15e8fabb93093090c7373d51
SHA1

cc8263d1068a44867cb244e806115fbe5a85157e
SHA256

8f966abbdae0232750fc6bc15ef89427d614b11723ee98d422a856feff7af042
SHA512

eca7cb986a22624e9cdf050b792493cb4972306315a42f485d574a35e554b9d6b5e5e2210bb64ab7974de84a415234bd55712640dba9f15fd0fca54bed59eade
SSDEEP

384:QUBBgGVs+vyv69AtJ7Ebu+VMx5d7sB3dt:fr/VniLxx5FC3

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe
1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe
1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 380	1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe	88
PID 1028 wrote to memory of 380	1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe	88
PID 1028 wrote to memory of 380	1028	17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\17c9376f15e8fabb93093090c7373d51_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\Temp\cleae5790e6.dll"
  2⤵
  PID:380

C:\Users\Admin\AppData\Local\Temp\cleae5790e6.dll

Filesize
15KB

MD5
2d7cabc37907d31a2dbeb2110a8aeb29

SHA1
e0ec267553c8717165f4e5c9cc212c87caa77186

SHA256
cb418947f0ba0843940c057559f7a2ea162b8f3453893c505ef81583ec68a100

SHA512
2c9f693241d4dac953361406c2a65966c9d29aa59bff58664c2700c6223bbb6ab6a7f6fb89efc6e6aa860e4bd1d5f9d700c0afe09500e6284a9ef40e0ad5ddb0

Download Submit
memory/380-3-0x0000000000400000-0x0000000000406400-memory.dmp

Filesize
25KB

Download
memory/380-6-0x0000000000400000-0x0000000000406400-memory.dmp

Filesize
25KB

Download
memory/380-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1028-0-0x0000000000400000-0x0000000000406400-memory.dmp

Filesize
25KB

Download
memory/1028-2-0x0000000000400000-0x0000000000406400-memory.dmp

Filesize
25KB

Download
memory/1028-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1028-11-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download
memory/1028-12-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download
memory/1028-16-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download