cfee5c29dfe0788bedbdefe1fab055667531f29800ccd706096c042506af87d4

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 17:27

Target

3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
Size

81KB
MD5

3a13c5141c3f9d4a021c65074afc945d
SHA1

c15f0476e52bafdd7438c7a278f70f20656c83d0
SHA256

cfee5c29dfe0788bedbdefe1fab055667531f29800ccd706096c042506af87d4
SHA512

e1f15ad8db6cf436291249d0517e1866e8c70c928fe54f27853561cfa6926d2a4c8b6ca5cbdf8de6b086ec7f68c5d856aa104ba1b6c3f338468ea5fb63f9ca75
SSDEEP

768:cjnF0Gpb5rkHF19erftpI9PNupCSqFcMwsYWL0is5Cr1aj4BNw67SMlSni4ZTJ2T:ceX97BNup1oKst0is5L4nw6uMGV14T

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4056	2060	3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe	83
PID 2060 wrote to memory of 4056	2060	3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
  2⤵
  PID:4056

memory/2060-0-0x00007FFBECE65000-0x00007FFBECE66000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x000000001BEF0000-0x000000001C3BE000-memory.dmp

Filesize
4.8MB

Download
memory/2060-2-0x00007FFBECBB0000-0x00007FFBED551000-memory.dmp

Filesize
9.6MB

Download
memory/2060-3-0x000000001C3C0000-0x000000001C466000-memory.dmp

Filesize
664KB

Download
memory/2060-5-0x00007FFBECBB0000-0x00007FFBED551000-memory.dmp

Filesize
9.6MB

Download
memory/2060-6-0x00007FFBECBB0000-0x00007FFBED551000-memory.dmp

Filesize
9.6MB

Download