bc4b35b90ddaa4e4f51263e9fb19ba303dba0f2d594a04d19d09eaf2b4cc874f

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 06:02

Target

37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe
Size

85KB
MD5

37f7d36cc1ba8e33f86335ab911ba860
SHA1

2da5bf11f517bb95fd2c75e1b25a23b15b0f171b
SHA256

bc4b35b90ddaa4e4f51263e9fb19ba303dba0f2d594a04d19d09eaf2b4cc874f
SHA512

582c96f7b02ca93627c4246cff6ee559b0812295e84df74a8ea284b03b0877532a918ded27abeb01b3ac486ee5b274d8ec5e743b2c21c21651f2035c930b302f
SSDEEP

1536:WeX9wBNup1oKst0is5L4nw6uM80CbB5UuUbVNd2G3jA:PX9EnsNiw6uM8RbBauUbVX2Gs

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3932	2704	37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe	85
PID 2704 wrote to memory of 3932	2704	37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\37f7d36cc1ba8e33f86335ab911ba860_JaffaCakes118.exe
  2⤵
  PID:3932

memory/2704-0-0x00007FF8CF3B5000-0x00007FF8CF3B6000-memory.dmp

Filesize
4KB

Download
memory/2704-1-0x00007FF8CF100000-0x00007FF8CFAA1000-memory.dmp

Filesize
9.6MB

Download
memory/2704-2-0x000000001BC40000-0x000000001C10E000-memory.dmp

Filesize
4.8MB

Download
memory/2704-3-0x000000001C1C0000-0x000000001C266000-memory.dmp

Filesize
664KB

Download
memory/2704-5-0x00007FF8CF100000-0x00007FF8CFAA1000-memory.dmp

Filesize
9.6MB

Download
memory/2704-6-0x00007FF8CF100000-0x00007FF8CFAA1000-memory.dmp

Filesize
9.6MB

Download