2f272b624b718162e48b4cdfa61c5f7a020ec4d54b291878023b3ee2d26128f6

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:20

Target

60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe
Size

32KB
MD5

60ebe0db55dfe3b41edd7870c2d0da8a
SHA1

78acd254cb796a675c6c2da2f964b70818b44b69
SHA256

2f272b624b718162e48b4cdfa61c5f7a020ec4d54b291878023b3ee2d26128f6
SHA512

28924ab9085643d5b749a428fe4f99cbe77563a9ce35b8762ae4a67860c6d2656e6edfbc85224405103dce3266f0f0209b71d83d9a7e8fdd760770ecf9dbbc4b
SSDEEP

384:h7vcS1D9XjqazLz7PMrzTLd965kdCSTD2dbjhrUy08wjteZGUei:hYSd9GknPMrLd961Sv2Ey/sUei

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe
4704	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 372	4704	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	90
PID 4704 wrote to memory of 372	4704	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	90
PID 4704 wrote to memory of 372	4704	60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste57c61f.bat" "C:\Users\Admin\AppData\Local\Temp\60ebe0db55dfe3b41edd7870c2d0da8a_JaffaCakes118.exe""
  2⤵
  PID:372

C:\Users\Admin\AppData\Local\Temp\uninste57c61f.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/4704-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4704-1-0x0000000001E50000-0x0000000001E54000-memory.dmp

Filesize
16KB

Download
memory/4704-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4704-4-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download
memory/4704-3-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/4704-10-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download
memory/4704-8-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4704-9-0x0000000001E50000-0x0000000001E54000-memory.dmp

Filesize
16KB

Download