e979737b900e639c960d2e61ca2a39790f39665aef09454b92afb7cdd3cabe03

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:22

Target

14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe
Size

2.2MB
MD5

14aa8cf19a3977206ca4865b44b4fdde
SHA1

a4d34ef39b95c852280412bd63a8d921223110e9
SHA256

e979737b900e639c960d2e61ca2a39790f39665aef09454b92afb7cdd3cabe03
SHA512

6fccb9e50def44534b9afa68df9a8020c0053ce7c88485178de883d2a87f791adfeb840e6473fc0b3ce8ad3829ca8cf4ae4132d3e48b6e688614164a31ce6493
SSDEEP

49152:7fMzhESaRtNSM88Wyrgb6TuBCINjR8O5ZjxcZ5B5yR:7fMeSasMkQgb6hi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4680	4196	14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe	81
PID 4196 wrote to memory of 4680	4196	14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe	81
PID 4196 wrote to memory of 4680	4196	14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\14aa8cf19a3977206ca4865b44b4fdde_JaffaCakes118.exe
  2⤵
  PID:4680

memory/4196-0-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download