01de343221f5e2225a4d99e4bb474eee555f89e27176ff7380b4300bf20bbc55

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 04:19

Target

4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe
Size

661KB
MD5

4447daff35b2a06aa5fb587c0848d102
SHA1

f0cb21f70356cf517c121c23b93d70485d98b96c
SHA256

01de343221f5e2225a4d99e4bb474eee555f89e27176ff7380b4300bf20bbc55
SHA512

74a2de4ee690f8218fdfe70594ece281e17273f00cf6fc3bc5f25f48a5e003b086d95328dbcf11e9f718a79d274da360cd3c4fd36ec5dbaef20f43813d93654e
SSDEEP

12288:aqS0ooP+uwLNWV/uw1ek0vf/wQm4g946T/5QzAg2pVpNuVupGXV09dhEa/8QG:Vgq+58hZ9UfZm9fQAg2DUupGeRm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4884	2164	4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe	86
PID 2164 wrote to memory of 4884	2164	4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe	86
PID 2164 wrote to memory of 4884	2164	4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4447daff35b2a06aa5fb587c0848d102_JaffaCakes118.exe
  2⤵
  PID:4884

memory/2164-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/2164-1-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download