3028fa6967ddd71f37ed18e9f90744ec32c2936635fa51f1e9e4526e354320f5

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 06:21

Target
4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe
Size 3.5MB
Sample240715-g4jjdaverb
SHA256 3028fa6967ddd71f37ed18e9f90744ec32c2936635fa51f1e9e4526e354320f5
MD5 4895a4a96af9d02844cdcbe01d5fa72e
SHA1 f5db0783e2040e084198510c3e9e47c4120ad662
SHA512 cbecc0d58c59c8849108594510a4dfa4cd3fe2b61f6624180a38dba08f69b90c3cf01340fcd72786b836635f77525f796c0b7eafa639d2ff74def3a3d39fe4be
SSDEEP 49152:z+UF5eIfqkVn/Bja5TyHPuK4AK4WXpMtOEcC86TNo5RcfzxgBfokwUkR1lKU/MGa:3F8XOZjaIPT4NIOPC8gbflgwUu3ChQc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4776	4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4776	4324	4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe	85
PID 4324 wrote to memory of 4776	4324	4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe	85
PID 4324 wrote to memory of 4776	4324	4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\is-DKA0S.tmp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DKA0S.tmp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.tmp" /SL5="$700DE,3230774,140800,C:\Users\Admin\AppData\Local\Temp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4776

4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DKA0S.tmp\4895a4a96af9d02844cdcbe01d5fa72e_JaffaCakes118.tmp
Size 1.1MB
SHA256 0c340a0c550cde8d73f7b109416faf9a1243c5bebcc5477123cb97028ba01088
MD5 8fd32d871dfd28c4519cd9c96a120026
SHA1 5bd078aabbc46eb2a04de766dccbc82a6782aef9
SHA512 86a83f54723ba2d90109edf3f26739e4798b756ec7dd04e50a9cc3eb9075d9f213f1074057b01af55e3fe980a6fef2bea8bffefe0cb6e25b95f7ae42e0fa96e8
SSDEEP 24576:S43B3soIVgjal+VKnI2zwyBCSdZqyT6fETf+7Z1mZkHxyA:93DYwO6l7eU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4324-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4324-2-0x0000000000401000-0x0000000000417000-memory.dmp

Download

memory/4324-12-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4776-7-0x0000000000400000-0x0000000000536000-memory.dmp

Download

memory/4776-13-0x0000000000400000-0x0000000000536000-memory.dmp

Download