cc4901446fa805c12b80fb99d823c67d62907596fae4ace229480610a439f024

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 07:51

Target

4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe
Size

260KB
MD5

4d684f1fc4af9716618de72078a5cc9e
SHA1

d8832b5e2414b13c3928c4880c93d117d4b0c4c6
SHA256

cc4901446fa805c12b80fb99d823c67d62907596fae4ace229480610a439f024
SHA512

c95c6237abebe0b2a6baa06a3fdddf04d8c163ec32e7f9b662c84fe6c9f907dc14d91345694d0c3e419e82792f60cead8325d4c4523d093b25d331f2ea024336
SSDEEP

6144:A2Rnh5EsIm2E47RNYQRRyXJpY09inGogj1Y3:Aeh5EsIY4dNPEZO090Ni23

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe
4300	4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4256	4300	4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe	84
PID 4300 wrote to memory of 4256	4300	4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe	84
PID 4300 wrote to memory of 4256	4300	4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d684f1fc4af9716618de72078a5cc9e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:4256

C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
89186869011165882b0a136403d3b9ae

SHA1
fa8d45bc821878b8786c116a2befea2585d057e3

SHA256
6ae586deb356fe429bbc053238f036dc92fb04aeea8d9d68357751b8c3938723

SHA512
51e2167e4bd8ff54480bf8c7d6abf5b6aef8b3a3e35e2d8e5d37ab6c8f32a1f01ea99524b8e2cc1b6256503c18f11521c874258fc9d7daa9d0d2b8df7862c9d9

Download Submit