a552c2fb491156e1e48046e85e9413608e107b664b32080c1bea7852956ffbb7

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 06:27

Target

2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe
Size

147KB
MD5

2b4d975d21d21fce7269f74fed43d512
SHA1

d10f6abccce2d7fa76abf63dfe61e91567030513
SHA256

a552c2fb491156e1e48046e85e9413608e107b664b32080c1bea7852956ffbb7
SHA512

d6e596c68463601a693d1ddfe16a2e450d0b61d6166dcf8dd5f1bc9850cf0067ad320618aa2ff088b058c44e60cf5a66391332d237163fb5afadf6f97b607b30
SSDEEP

768:hCraj/mNV/sWjBZyCKs8Nws2+yVIkt2mDA/vpV/JsbruRcN6cfjGwgif/D3VTdUw:srSeYWjBkwecskmuN62aGWA9AA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3356	3384	2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe	83
PID 3384 wrote to memory of 3356	3384	2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe	83
PID 3384 wrote to memory of 3356	3384	2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2b4d975d21d21fce7269f74fed43d512_JaffaCakes118.exe Y
  2⤵
  PID:3356

memory/3356-1-0x0000000077880000-0x00000000778A0000-memory.dmp

Filesize
128KB

Download
memory/3384-0-0x0000000077880000-0x00000000778A0000-memory.dmp

Filesize
128KB

Download
memory/3384-2-0x0000000077880000-0x00000000778A0000-memory.dmp

Filesize
128KB

Download