589d20cbc298aa2e475af7db64239468056bffdddd178eaf4f51762c5bfd49de

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:23

Target

1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe
Size

1.9MB
MD5

1523980872ad3824c9b9a23b2b5ffcb1
SHA1

c88047b473ba15debf5dac04a627029150c9d887
SHA256

589d20cbc298aa2e475af7db64239468056bffdddd178eaf4f51762c5bfd49de
SHA512

9b76135fa074d13b86725b5832c72f6cab3fa8db78c4ea3d45ee61aa18b29da61acb5da19d10c65f39a0426e50f28b99bd89833d611e06ef53f8e936c8ddbeea
SSDEEP

49152:Qoa1taC070delhyAeS0SxEvR3ks34+VO2e7EAm:Qoa1taC07ReS0SxEvR0MCEX

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3668	5043.tmp

Executes dropped EXE 1 IoCs

pid	Process
3668	5043.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3668	432	1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe	80
PID 432 wrote to memory of 3668	432	1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe	80
PID 432 wrote to memory of 3668	432	1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\5043.tmp
  "C:\Users\Admin\AppData\Local\Temp\5043.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe 311BCE5F499C12ADC22432EA47E54DCF64D5D56C65BB4081CE0CD9781CF921C0A9DFE1058815FA353EE17F4A60D0F9A50A86C844984F0DAC6E615BAB87116B22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3668

C:\Users\Admin\AppData\Local\Temp\5043.tmp

Filesize
1.9MB

MD5
e4923027ba2f6912bfe134bc34b37d26

SHA1
09f9f3dcf2107399f8d4be183311606b53ca0569

SHA256
404ac7a3619a2fc2534fc7ee4cc47bf31fda2ba385456c5f2f3c6e0614852cc0

SHA512
1964c69bc1b20c515c03c194bb3d79fa306e5af74f4f68f68d572a5714b2023345083878fe2114879a9f41f2f7b301cf319e9f053110c336590449427a1c14e1

Download Submit
memory/432-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3668-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download