d1eea20d42bb0eb0531c36a7d2facc1077f641a99b6875267e9b4eb0ef8d7399

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:23

Target

3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe
Size

6.7MB
MD5

3af249d0e9b2a4477252e48270e93f27
SHA1

e4f08968941b42ee5b35a16fe65bb2011a76abe8
SHA256

d1eea20d42bb0eb0531c36a7d2facc1077f641a99b6875267e9b4eb0ef8d7399
SHA512

33859aabbfa2459408293faf9b30ebfba2cc33a9d9ebae2c754a85fb35499c10375760e155b392595cd13f227050d6047c680fdcc95aa4b69e497c590202d621
SSDEEP

196608:9Is0tqKpGjOdhKGCJIBwj1e6gz7XxStn2Nu:937KpldnX56gHXxwn2s

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3912	3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3912	4012	3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe	85
PID 4012 wrote to memory of 3912	4012	3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe	85
PID 4012 wrote to memory of 3912	4012	3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\is-M2205.tmp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M2205.tmp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.tmp" /SL5="$80046,6679509,82432,C:\Users\Admin\AppData\Local\Temp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3912

C:\Users\Admin\AppData\Local\Temp\is-M2205.tmp\3af249d0e9b2a4477252e48270e93f27_JaffaCakes118.tmp

Filesize
736KB

MD5
cfa27f3b86a04083208f2278f83a5682

SHA1
5c4d02f7bac4e205bd37e44a44d627b92d33f333

SHA256
857f210dd2ecd87193413bec6426c85107b0c2d1e7cbccc41e79e97c8722970f

SHA512
4a63d3b0ded375ba954bd7a0272a6c07b1c217622cbcad2ab9b3282edd24ebb163ccc6403b6328ece3ebf5ff78bd55d231bb83044390272d471c1e460c18cc13

Download Submit
memory/3912-12-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/3912-14-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4012-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4012-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4012-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download