0c68a55add1a53aa3c2024776102182d2c98ab4f9015ad342ec4d2bffd35783f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 22:12

Target

3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe
Size

3.5MB
MD5

3f13bd0dae26493ac95ec0521c3d615a
SHA1

fe0633d555304bf496aa0c8ee4035ea4119836ce
SHA256

0c68a55add1a53aa3c2024776102182d2c98ab4f9015ad342ec4d2bffd35783f
SHA512

aa0672b1495bba1d7d0512f7a3588b1f587595fc92c0ae0fc582092e423a3512010f810d845b85b3db61e2a3f16fb96321942d2f0a44fffc0b438da224c894f8
SSDEEP

49152:j+UF5eIfqkVn/Bja5TyHPuK4AK4WXpMtOEcC86TNo5RcfzxgBfokwUkR1lKU/MGM:HF8XOZjaIPT4NIOPC8gbflgwUu3ChQa

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1892	3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1892	4180	3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe	85
PID 4180 wrote to memory of 1892	4180	3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe	85
PID 4180 wrote to memory of 1892	4180	3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\is-NCS28.tmp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NCS28.tmp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.tmp" /SL5="$50236,3230774,140800,C:\Users\Admin\AppData\Local\Temp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:1892

C:\Users\Admin\AppData\Local\Temp\is-NCS28.tmp\3f13bd0dae26493ac95ec0521c3d615a_JaffaCakes118.tmp

Filesize
1.1MB

MD5
8fd32d871dfd28c4519cd9c96a120026

SHA1
5bd078aabbc46eb2a04de766dccbc82a6782aef9

SHA256
0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088

SHA512
86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8

Download Submit
memory/1892-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1892-13-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4180-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4180-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/4180-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download