51ab3edd7006be89892ad851fa4471a071a0b28de8fea85904ccb83e3cce964a

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 03:36

Target

4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe
Size

116KB
MD5

4ca7bfed7aa4114656cbbf2ee80684f8
SHA1

8fe148a4acf83eb1c01fbf2ca8dc61c3d43ae6b3
SHA256

51ab3edd7006be89892ad851fa4471a071a0b28de8fea85904ccb83e3cce964a
SHA512

432fd226b75a074b5e63bfd14cc2948853d779c775745db1f213b070e1946fb0d2ab50e83f389f35ca661d756acc185aaac52ab59e08289ee3190d245a154daa
SSDEEP

3072:QUvu1ilO3RbXjB9p9K/SkMgtIyBzJJqJLEH0Ws:FvICO3RbTG/SPqIW0Ws

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3556	4852	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	86
PID 4852 wrote to memory of 3556	4852	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	86
PID 4852 wrote to memory of 3556	4852	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	86
PID 4852 wrote to memory of 3556	4852	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3556