d390ad5ed0eca48fd878360de1ead84d2b82f4d40e17f961d59e916a63be5a50

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:42

Target

3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe
Size

8KB
MD5

3b8a9d9da8f6e9c526f1ae0d0dee859b
SHA1

2a1e3a9399b4e2d8f9462ddadf17b85cf5f9fdc1
SHA256

d390ad5ed0eca48fd878360de1ead84d2b82f4d40e17f961d59e916a63be5a50
SHA512

1f0002e71b54b289de6d8164d0d6021465b58dced564ba912038b22ee6ad702199a67f8e8d5d794428dfd5b3eea83993d52610b796aa2a96c8129127e79cfa7f
SSDEEP

96:5dk491Sp4hJCyV7nS62sQC4o4fOYyTSzm9izZp43Z9N8PJ:zR964bCyV7SM4o4feeEEZpaHUJ

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 644	3256	3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe	84
PID 3256 wrote to memory of 644	3256	3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe	84
PID 3256 wrote to memory of 644	3256	3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe	84
PID 644 wrote to memory of 772	644	cmd.exe	85
PID 644 wrote to memory of 772	644	cmd.exe	85
PID 644 wrote to memory of 772	644	cmd.exe	85
PID 644 wrote to memory of 5112	644	cmd.exe	86
PID 644 wrote to memory of 5112	644	cmd.exe	86
PID 644 wrote to memory of 5112	644	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b8a9d9da8f6e9c526f1ae0d0dee859b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240617937.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\net.exe
    net use f: \\192.168.45.3\msi$ MP497cwd /user:msi_kynt
    3⤵
    PID:772
- - C:\Windows\SysWOW64\net.exe
    net use /persistent:yes
    3⤵
    PID:5112

C:\Users\Admin\AppData\Local\Temp\240617937.bat

Filesize
92B

MD5
1d3bb40079e2ca78f244ea377795797b

SHA1
4a2b870c23c88a3c87cd9a4feb8ebef76a6be838

SHA256
e04cdc4c1c34a7038631bae63cd96f222e9de4400105c804616c95986d8c89be

SHA512
014cd154d03afb1559c53c62bca9cf6e4efb52c3d2bf83fb4ce2eb71b734e41cd2324222f7b65bd09d950ef6d8af828a8bfd539b54b2adbb0d9d17c2ae6203d9

Download Submit
memory/3256-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3256-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download