530461af0bbe905d2f67fe690369063733dc6641e7468ba2aaf33248627c9cbe

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 16:34

Target

63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe
Size

2.9MB
MD5

63f0c916dce5ab5a6f958578882638a8
SHA1

41a7b599d92a63cae457252b8c44e53d2bea85c6
SHA256

530461af0bbe905d2f67fe690369063733dc6641e7468ba2aaf33248627c9cbe
SHA512

c1379cb53e4bb2b0e27158aa8ab9be8727cca262aa1ac38b22bc3af683863e1daa04f2f9430900608d375355079ebef116bd76617ef637b9dcae4faea83c79e4
SSDEEP

49152:WWsDODrOO53RTqtighKPgssSt2g6c9IW1dXgfC/MHmgJ0g7mM+M6RkMkIM7I067W:3sDODrOO53Ahv7Stgc9IW1dXgfC/MHmq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4752	2548	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	85
PID 2548 wrote to memory of 4752	2548	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	85
PID 2548 wrote to memory of 4752	2548	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\hh.exe
  hh secedit.chm
  2⤵
  PID:4752