401dfdfc6fbce2e7adabd5cef598070271cbc0e7cce2971689ab4096be68e474

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 09:51

Target

343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe
Size

270KB
MD5

343a4997454d8cfcf82f719af313f85b
SHA1

1102db42480f5e34ecdbbba79261352adb6fcff4
SHA256

401dfdfc6fbce2e7adabd5cef598070271cbc0e7cce2971689ab4096be68e474
SHA512

7c6a556585482e55499ff8724fd17556d4b2d733f8106ac9a89cde6d496dfef831950073aba07a1c340a54cabf5b5b9b0e012113deee5fddaeb9fb863c77c193
SSDEEP

6144:JZlHPjEWoNKsrKPBqZ5x5CyWEfNPcx75sVFrkTyJ0sYv6:JXHPj6os+ct9fNEx7509kTyzYi

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2010.txt	343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3816	4208	343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe	85
PID 4208 wrote to memory of 3816	4208	343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\343a4997454d8cfcf82f719af313f85b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4208
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:3816

memory/4208-1-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download