3e2344c74583ece53264230de02e6788c4fd133695cd1f295193991e8cf1b96f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 16:23

Target

26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe
Size

925KB
MD5

26d46d11cebbddc7b80ea141ce40e4e9
SHA1

ecb824b5ffd16c905b0c34ea91269443bbc7c86c
SHA256

3e2344c74583ece53264230de02e6788c4fd133695cd1f295193991e8cf1b96f
SHA512

91a3b4581ff4f3c3dea443e43072cc8163f6143452596afd9d3a8286488f600b04d0583a02b6a0d18d72742eb5bf71bdd87bd03c7faef60cea821d7c498c308b
SSDEEP

24576:qKeyxTAJj7P+yWwWAnCpzgwptYFUx1e96JmyIak7:qKeyRA0yzW1PtYFUx1ekoak

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2120	elbwluqho.exe

Loads dropped DLL 1 IoCs

pid	Process
1388	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\pficsx\elbwluqho.exe	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2120	1388	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe	28
PID 1388 wrote to memory of 2120	1388	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe	28
PID 1388 wrote to memory of 2120	1388	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe	28
PID 1388 wrote to memory of 2120	1388	26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26d46d11cebbddc7b80ea141ce40e4e9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\pficsx\elbwluqho.exe
  "C:\Program Files (x86)\pficsx\elbwluqho.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

C:\Program Files (x86)\pficsx\elbwluqho.exe

Filesize
940KB

MD5
64fb12521288a1ad3bb719d20da126da

SHA1
137f48daf29a940a9ee1c3e6e1d886a5b3686bcf

SHA256
636f8362f147d60165a6683ff3f94dee98a43bbacc9bf446aaa909fce2be7d25

SHA512
0383d5a9c9f6fc37a26d4009a8ba06127212a67ae4b2d5d6be576462c964d10a0eeaa2e5647dca939de060a6fda0924943cb67ffb90ec8866e7e15d8c1ae60e0

Download Submit
memory/1388-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1388-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1388-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2120-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download