16beb51db5cf471e6bf1fe883d4a48e163035d1f815d146e1c262feb6f6f1fac

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 21:44

Target

10d54d3420877345937de6fae4142eea_JaffaCakes118.exe
Size

2.3MB
MD5

10d54d3420877345937de6fae4142eea
SHA1

b7423a81ae49e8438b03f284d3d9e871c3a9fb6c
SHA256

16beb51db5cf471e6bf1fe883d4a48e163035d1f815d146e1c262feb6f6f1fac
SHA512

f162d28c5c9e158af059de121d3ba2dd641a610fa6076dcbdee9ca674bb4104e23fe29020825aee1a80cfdd3f0bdd0b0a862355ef754004b5c3703b2ca25afb4
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRW9Zce3FPw58OV1:dqgazxcGYN139lnk30rDEYqMpO8BbNDX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1972	qojzib.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\psbxyk\qojzib.exe	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1972	2200	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	28
PID 2200 wrote to memory of 1972	2200	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	28
PID 2200 wrote to memory of 1972	2200	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	28
PID 2200 wrote to memory of 1972	2200	10d54d3420877345937de6fae4142eea_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\10d54d3420877345937de6fae4142eea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10d54d3420877345937de6fae4142eea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\psbxyk\qojzib.exe
  "C:\Program Files (x86)\psbxyk\qojzib.exe"
  2⤵
  - Executes dropped EXE
  PID:1972

\Program Files (x86)\psbxyk\qojzib.exe

Filesize
2.3MB

MD5
6bb4bcc5df6dadc307619104b46900d3

SHA1
0a0d01c06d846004a587758fcc677188477e8122

SHA256
baf6cc8e502f1df65bcd7c0044c73daf51f86f5d6dfc80e65708169ed227f18f

SHA512
f33387c17a3d029b2291ab0663792c95af09ea774d82807515b07ac3fc82cdccfa0c886daf9da241e525d35bf337cc38740593b7990ceaf919170bca247b4f7e

Download Submit
memory/1972-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2200-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download