5c3b2fe5873a54967b60abe38b7667f061e96ca69e494a3ee785e3ccf90b6f44

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 21:53

Target

3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe
Size

1.9MB
MD5

3f04c30b7cc8af8b444f8a9d600508fc
SHA1

6fd4bd6586385a6ccf73726c440a7641eb2f333f
SHA256

5c3b2fe5873a54967b60abe38b7667f061e96ca69e494a3ee785e3ccf90b6f44
SHA512

3d5caebfd38a067aa703db655410cc2c0eb3cc3d371053276f39d3e536f75687183ba83177039b7a68b2a67f25687db03279a0fe4fa700cb30d1ad0e4525a313
SSDEEP

24576:Kh5tIWRAMj8LWSm7J6/gvq3lIH1PyXSmFwOpzhl5IBKAl0Ndrpwy1j5cIdYAMn1r:Katm9S3qP3mF/p/Cxw8vR0

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3544	3992	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	88
PID 3992 wrote to memory of 3544	3992	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2400

memory/3992-0-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/3992-1-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3992-2-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download