59e413b4db8a414f1cf2b1fa1ee6a2224896caf7fb2ef7fe1075b4e5574924a4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 12:19

Target

3059bcdd77fbe0c61d6b31c293c07ce3_JaffaCakes118.exe
Size

136KB
MD5

3059bcdd77fbe0c61d6b31c293c07ce3
SHA1

45e514a298436a12326253ba5c487e105fb8d975
SHA256

59e413b4db8a414f1cf2b1fa1ee6a2224896caf7fb2ef7fe1075b4e5574924a4
SHA512

be4107dd2ffab0b19a788a60969253d12d461afa783b18fa60986ff17642ec4a82f5f5db9399f40d11b6053f94f84ca78823624c083f9db9e929e2a4babb440d
SSDEEP

1536:J1qnQxlaefGsEmNIT08JI/ptMfBQeQmb9kKhwR7JMaCa2YVOcKjKZ6x4:UUla8oT/CptqRkLT+a2YVONWZ6x4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2896	winload.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 2896	3224	3059bcdd77fbe0c61d6b31c293c07ce3_JaffaCakes118.exe	82
PID 3224 wrote to memory of 2896	3224	3059bcdd77fbe0c61d6b31c293c07ce3_JaffaCakes118.exe	82
PID 3224 wrote to memory of 2896	3224	3059bcdd77fbe0c61d6b31c293c07ce3_JaffaCakes118.exe	82
PID 2896 wrote to memory of 3464	2896	winload.exe	56
PID 2896 wrote to memory of 3464	2896	winload.exe	56
PID 2896 wrote to memory of 3464	2896	winload.exe	56
PID 2896 wrote to memory of 3464	2896	winload.exe	56
PID 2896 wrote to memory of 3464	2896	winload.exe	56
PID 2896 wrote to memory of 3464	2896	winload.exe	56

C:\Users\Admin\AppData\Local\Temp\winload.exe

Filesize
48KB

MD5
413b7d27725cbb6bc3d3fc3a267f0077

SHA1
38589121b4f65312304ae28eccbb7f36cc539215

SHA256
4b0c2f86a2a347919ec1ffb63bdfacd26e1902ee3e0edd463f06ef478b2f38f8

SHA512
eee6be801730133ebbe7fc1311b0e69af9bdec25882431cec48a9e83a7c7fe1daec19a866e7ab05dddc9b8fda96797f14857a669334ce46fd1e9fcf574cd5dff

Download Submit
memory/2896-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2896-6-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2896-7-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2896-16-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3224-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3224-17-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3464-9-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3464-11-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download