2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 14:00

Target

35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Size

932KB
MD5

35052f149100475f8307e1d04697ed32
SHA1

6aa986abbd9ee14710b34a4e631520d100cef8bb
SHA256

2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4
SHA512

54e293a74b90ffabb39cc015a17b55fa22d3e2cd0a898a68739eee6fc9488c8cebf9e05ff26f9dbcb2ba6d1e288c3a1ac09edf1375857f4f09b8a14aa5553bec
SSDEEP

12288:1Xmc2JMORj5NPrpGa9a1U53gbFm33WP34Hrk3ajUWm2mDj4nnmsEmS:B5qPPltA1UtF33WA9jUWm2mDjdH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 896	4152	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	83
PID 4152 wrote to memory of 896	4152	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	83
PID 4152 wrote to memory of 896	4152	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\qelizresa1.bat
  2⤵
  PID:896

C:\Users\Admin\AppData\Local\Temp\qelizresa1.bat

Filesize
239B

MD5
d6b1f5f225c4f1df127db0273ce51270

SHA1
ab06a820e723537d3e66bb92da194bc8cf17ad20

SHA256
f5730a8642942f7fdad29bdd9be7a5f11c43175c82bb3185b1d210ad6c7c4727

SHA512
bef9b0edd513fb5e3ebf64163d51e7a71d1caee20f0f566a8d1a204a73004bd4528cb166eb5243168752655d7196b7f7920bed51cbd625eeea626bf3d63c1b25

Download Submit
memory/4152-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4152-3-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download