1b163589a177a2f2446af86f7612924dabdea015834a8e6220014b7353c3a5be

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 08:39

Target

21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe
Size

64KB
MD5

21bbaca9de42dd433c24f830b2d9dcd8
SHA1

47cd87bc9bd661631be1e5adb30f9531614de4a4
SHA256

1b163589a177a2f2446af86f7612924dabdea015834a8e6220014b7353c3a5be
SHA512

704b1fa255708d7cb27c2d8ae63bf609fc56a95eb19965e22046977f7fcc850a51030fe653624cbc53cb9043f5078e9b86b09c919e14dec5707e02db1da6807c
SSDEEP

768:BBsypoWmwu+xxDqRQAfTFFLffkYs/g79W7iJzl627SLt8gLOU2FHD+mJ3VseN5C8:fBoWdHaDLw7iJvu+gFEJah1B+ILaxCqR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4568	3216	21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe	81
PID 3216 wrote to memory of 4568	3216	21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe	81
PID 3216 wrote to memory of 4568	3216	21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt45758.bat "C:\Users\Admin\AppData\Local\Temp\21bbaca9de42dd433c24f830b2d9dcd8_JaffaCakes118.exe"
  2⤵
  PID:4568

C:\Users\Admin\AppData\Local\Temp\bt45758.bat

Filesize
75B

MD5
d99e360f533b01b8d1be07bed6e25af4

SHA1
e2d593e94b82e6f16f808f417aff61e93458924a

SHA256
c9d6a68b4512772cf3103faf8c75455e067726323e9aabacb37c199ebd844e08

SHA512
5cd0368cfe33af285f6be47b67e8dda36fc5ad3b3cce798bb7ab050bab60f41f502ed34356b1091c4549b0a9fed65f5415cfb62c9c0ff51e631abbc4e1ae3261

Download Submit
memory/3216-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3216-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download