aa1bc0eef0806b9e2e5d073872f95ee8ade41e561cb800df0ea7aa8c7109f603

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:28

Target

3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
Size

18KB
MD5

3a9b056c0f6e767f0e8f51e4ecfda6a3
SHA1

3ea6a0531c06b65015a1ac297224b80dd26a2975
SHA256

aa1bc0eef0806b9e2e5d073872f95ee8ade41e561cb800df0ea7aa8c7109f603
SHA512

3808abab49f1a538c3dedb0158d2d5e96b845b39355cd1a733cfa67526898e935461c437f9d054cbc78e6a637d837dd881f33310ab6ca44c2d9337e8ec1a4dc6
SSDEEP

48:QMIIILeOnNgg1EEWsiryoizX6U9CBanlEP+/y6CXduvdHyRIpm4H3AVauwOL9xCl:QjNgOAi4vwFSRh/9x1gajwF

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 464	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	83
PID 728 wrote to memory of 464	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	83
PID 728 wrote to memory of 464	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	83
PID 728 wrote to memory of 5116	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	84
PID 728 wrote to memory of 5116	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	84
PID 728 wrote to memory of 5116	728	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c.bat C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
  2⤵
  PID:464
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5116

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/728-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/728-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/728-3-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download