687b0835cdd064026056c8638a931918b3d2a96f38833f7196c41e74825f89b1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 22:40

Target
4bb79b02625d9cef10ebcd3dadf49c94_JaffaCakes118.exe
Size 354KB
Sample240715-2ll7rsvgra
SHA256 687b0835cdd064026056c8638a931918b3d2a96f38833f7196c41e74825f89b1
MD5 4bb79b02625d9cef10ebcd3dadf49c94
SHA1 2e7afadf255ede62780612866db3aaa2785a073e
SHA512 3ecf93a9f8b789b44c2c47bf8f53e5c18886251a99cb1a17f7a84643a1a4031516f06816f2a48468262a2392af98354bbeef60298e962a5ac8266e9c8802976c
SSDEEP 6144:5Ca8UZUH3D8WXWRau/TP/ipcOR4vW4i1zA+mflRF60iBTovfG+GIm2tRZ:5ILD8Fau/TXiPR4O4i58flRF60igu+G4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2996	3552	4bb79b02625d9cef10ebcd3dadf49c94_JaffaCakes118.exe	86
PID 3552 wrote to memory of 2996	3552	4bb79b02625d9cef10ebcd3dadf49c94_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4bb79b02625d9cef10ebcd3dadf49c94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bb79b02625d9cef10ebcd3dadf49c94_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" üë^‹þW¬<Zt,AÀàŠØ¬,AÃªëìXÃèáÿÿÿILOMOIAJAAAAAAJAJAJAJAJAJAJAJAJAFOAPDBLJAIAAAAAAILNAFGIKMCCEAPAEEBIIAGEGMBOKAEOCPCMGAGAAFOILHNAEIDMHBFDDMAFGFHFAGKAEFAGKPPLILABGNFHGPPNAILNIIFMAHFBALIBAOANFHGPPNADNLHAAAAAAHELJOLEODDMAFHFAFAGIBPAAAPAAFDLIJAPFNFHGPPNAIFMAHEDALJAJAAAAAAIJAEAIIJFMAIAEOIBEAAAAAAILOMILHFAEILFOANPPHGAJLINAAFNGHGPPNAOLALIPEEAIAIILPIPMPDKEOLAKFDLIOACONGHGPPNADDMAILOFMDZ
  2⤵
  PID:2996

memory/3552-0-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/3552-1-0x0000000000400000-0x00000000004D3000-memory.dmp

Download