6bf0d7d379114b634766666c9be5f6ae874c82bea5ccfaf3fed5d6d07567f11b

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 18:55

Target

3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe
Size

1.2MB
MD5

3e7cfb168cef65a018133960b836a45a
SHA1

cd810652818ff8065f26495fd9cb19f8d78d0de2
SHA256

6bf0d7d379114b634766666c9be5f6ae874c82bea5ccfaf3fed5d6d07567f11b
SHA512

ac366335f6ec432a53a4895990d9543dc81d45f323966e79eb4bbb85519fd62884a1df9fc74966ca0a9037c312efd2a5a633cb6c88823d400cc84d6d498c2e7c
SSDEEP

24576:8naNm1/fqXfnug9LzaopbMIh5jOln8K/3CrcoFfvxjtN/5ci2W1G:8aAJfqP99LrFUqWyrD5ZNX2WG

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3216	3e7cfb168cef65a018133960b836a45a_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3216	4020	3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe	84
PID 4020 wrote to memory of 3216	4020	3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe	84
PID 4020 wrote to memory of 3216	4020	3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\is-B1VCG.tmp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-B1VCG.tmp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.tmp" /SL5="$501F0,867093,166400,C:\Users\Admin\AppData\Local\Temp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3216

C:\Users\Admin\AppData\Local\Temp\is-B1VCG.tmp\3e7cfb168cef65a018133960b836a45a_JaffaCakes118.tmp

Filesize
797KB

MD5
7e00d5a59d18abb094979857a4495518

SHA1
f7cdccd9a03a260c7d0b724df5fee2ee1dcb22d6

SHA256
eef170da7985900955d7fe4229c136045fc4bfc7a350a033d484b0cc4c82cb08

SHA512
5697e7b6a30df3f74c7d469fac0d02717cbc9511a0681cc9d65032a50124ca572584f80ab9b39fca7a74ce76a0e01cbb63bdd1f66d39be3f48beb2b362120492

Download Submit
memory/3216-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3216-14-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4020-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4020-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download