6255445d56b8372ff913426736b950814987686116b27afc927f0fbdb05d6373

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:09

Target

15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe
Size

268KB
MD5

15453e96d559f2ced4365d84219d0548
SHA1

65aee8c126890f7476870974a521895e6e7e436f
SHA256

6255445d56b8372ff913426736b950814987686116b27afc927f0fbdb05d6373
SHA512

32371f12cae8e44aa611b932ef830333c992e4213166d99a5190325492524c218daf3460753a3ffe9a8cf77d60d064970c27a1b8c74d61052fd0bf9ab52cd5f8
SSDEEP

3072:ZvWVRWSq4m1eKcdOjO5OKUw7V89wmnfLSUkYhk9s42TqbVKuh+DEOXpq0q3/5ZV:sRWSqVEUzRnfLSokPvVADEO8TB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4404	1928	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	85
PID 1928 wrote to memory of 4404	1928	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	85
PID 1928 wrote to memory of 4404	1928	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- \??\c:\users\admin\appdata\local\temp\15453e96d559f2ced4365d84219d0548_jaffacakes118.exe
  "c:\users\admin\appdata\local\temp\15453e96d559f2ced4365d84219d0548_jaffacakes118.exe"war3.exe"
  2⤵
  PID:4404

memory/1928-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4404-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4404-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download