1de334de5104997e4ea975d7d21a84d2111037d6ed2925f76326ea0a553080e2

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:06

Target

36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe
Size

1.0MB
MD5

36618e6e7db49d195170a887f2fa138c
SHA1

82c560ffb219c6b8548f10d82a18077025ee4628
SHA256

1de334de5104997e4ea975d7d21a84d2111037d6ed2925f76326ea0a553080e2
SHA512

c8179faae357134602324df5c4405eb997b30c23e7057e63727e5349cb52cd1f348f7503efc8ea39acb56d88f2d1b6bc29be9f71428b01fd0dbeaf021df0465a
SSDEEP

24576:T87phtIkKusdLXUqUusB8vkKtLN5pp/1JixRa9:URHuY8hN1sS

Score

7^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe

description	pid	process	target process
PID 3124 wrote to memory of 1420	3124	36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 1420	3124	36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe	vbc.exe
PID 3124 wrote to memory of 1420	3124	36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36618e6e7db49d195170a887f2fa138c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
PID:1420

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3124-0-0x00007FF90F095000-0x00007FF90F096000-memory.dmp

Filesize
4KB

Download
memory/3124-1-0x000000001B230000-0x000000001B2D6000-memory.dmp

Filesize
664KB

Download
memory/3124-2-0x00007FF90EDE0000-0x00007FF90F781000-memory.dmp

Filesize
9.6MB

Download
memory/3124-3-0x000000001B840000-0x000000001BD0E000-memory.dmp

Filesize
4.8MB

Download
memory/3124-4-0x00007FF90EDE0000-0x00007FF90F781000-memory.dmp

Filesize
9.6MB

Download
memory/3124-5-0x000000001BDB0000-0x000000001BE4C000-memory.dmp

Filesize
624KB

Download
memory/3124-6-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/3124-7-0x000000001BEE0000-0x000000001BF2C000-memory.dmp

Filesize
304KB

Download
memory/3124-8-0x00007FF90EDE0000-0x00007FF90F781000-memory.dmp

Filesize
9.6MB

Download
memory/3124-9-0x00007FF90EDE0000-0x00007FF90F781000-memory.dmp

Filesize
9.6MB

Download
memory/3124-10-0x00007FF90F095000-0x00007FF90F096000-memory.dmp

Filesize
4KB

Download