4a9926ef5f47f758fbfcc420b7844c470519b73076d85008ecb2a8d2741bbdb6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:46

Target

40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe
Size

5.3MB
MD5

40cd28dff0339818bf625fda3b0fa4be
SHA1

c03a6b3f0b0d22a605359f8ea76865d3aca3d3ba
SHA256

4a9926ef5f47f758fbfcc420b7844c470519b73076d85008ecb2a8d2741bbdb6
SHA512

e6da4d291556145b41ecdb096182611e451dfaf7d8a1480f0e19547c5b41b703b1bb8ac0449e57b5c1ee033f295da27c5af79453832c9b3fa398a3efb0193633
SSDEEP

98304:kUIp7HIQ87fWFBAbMc1NSGBwGi8n7vpP1t7gSMfAOx5Jjg0IpUUTylCOhA9L:TIB8zeoH3SGNi0vNgHrxnUei9L

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3624	40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3624	800	40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe	85
PID 800 wrote to memory of 3624	800	40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe	85
PID 800 wrote to memory of 3624	800	40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\is-AO3BT.tmp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AO3BT.tmp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.tmp" /SL5="$602DC,5174485,52736,C:\Users\Admin\AppData\Local\Temp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3624

C:\Users\Admin\AppData\Local\Temp\is-AO3BT.tmp\40cd28dff0339818bf625fda3b0fa4be_JaffaCakes118.tmp

Filesize
686KB

MD5
e72a086eb6ae90ebcf93d057a39eed6a

SHA1
8d3808d0f5b3953d377c47200e719cbc49c08ab0

SHA256
c0fcf5409d5f937962b33c027b004402b1c79a9e899fa0d30371e13767cd9eb5

SHA512
8f3f8c8ea866b6e6348e588ed9aae1b80d685aed421a47077c8f6df65f2427fb860b394e49b3fbea228c9a806a074fd94cb5b69bc3d33cc0579def08bcbf66f0

Download Submit
memory/800-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/800-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/800-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3624-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3624-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download