6d60d88c9dd61cf7d5f1b143e8ba3a7584ce6ecefb86e3f084f0cf750342f5aa

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 09:09

Target

21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe
Size

617KB
MD5

21cfc302a2fe51f308df70630a04769b
SHA1

cb420f8c1b2662076d2b551715fe8cb2d801d374
SHA256

6d60d88c9dd61cf7d5f1b143e8ba3a7584ce6ecefb86e3f084f0cf750342f5aa
SHA512

5c0bd08c06d9679b18db8ce84498b8af0b6b470eb9d768120f68384c79bec520285df2535ce125e8ca208ff681f08012c8f1e5fb09ec7180686b9421d65f55a1
SSDEEP

12288:y3MjhxU888888888888W88888888888io+kBdvF7WTkS35nJh/jhFuMlKqJluoHP:cMjhLdkjF7WQu5n1lKUTH7MGbER/Qh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4464	21cfc302a2fe51f308df70630a04769b_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4464	900	21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe	83
PID 900 wrote to memory of 4464	900	21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe	83
PID 900 wrote to memory of 4464	900	21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\is-SOH7O.tmp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SOH7O.tmp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.tmp" /SL5="$701CA,234653,140800,C:\Users\Admin\AppData\Local\Temp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4464

C:\Users\Admin\AppData\Local\Temp\is-SOH7O.tmp\21cfc302a2fe51f308df70630a04769b_JaffaCakes118.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
memory/900-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/900-3-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/900-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4464-13-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download