f349acd7d4814ad4c79ec769c3d74a8a737025cbf2cd737fd288c26aecd7a9cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 19:45

Target

c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe
Size

3.1MB
MD5

c120cc33ca9d4a29e0f13d7189ff6c69
SHA1

977d85c1623215b418d4294fa7bbcba81629c62f
SHA256

f349acd7d4814ad4c79ec769c3d74a8a737025cbf2cd737fd288c26aecd7a9cb
SHA512

93700a0fa8769f90398265e94c3eae044c2aa50ea676b037d100b830b449be7b4e4a1c582dc005a97bc7697a1e8fd05cc41d0fc566d7aa7e0c79f0989a75695f
SSDEEP

98304:5mSWOiIyU3nzf5bXrUyQHSVLUjH5oxFbxx:5XVf5bXgyKSVUjZEdx

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2260	A2E.tmp

Loads dropped DLL 1 IoCs

pid	Process
1756	c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2260	1756	c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe	28
PID 1756 wrote to memory of 2260	1756	c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe	28
PID 1756 wrote to memory of 2260	1756	c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe	28
PID 1756 wrote to memory of 2260	1756	c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\A2E.tmp
  "C:\Users\Admin\AppData\Local\Temp\A2E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c120cc33ca9d4a29e0f13d7189ff6c69_JaffaCakes118.exe 3D8DFDDA29872C9A3D2F33766D94F9ADB432CA5A37EF7DDA93989774DD1E11371D1E22AB691D93FCAE77A1240D4CCAFF7AB613E2228C8541E057BCEAD69C7689
  2⤵
  - Executes dropped EXE
  PID:2260

\Users\Admin\AppData\Local\Temp\A2E.tmp

Filesize
3.1MB

MD5
5d89676c1ede14a13b8646178a4c4b19

SHA1
7e6050ffd1cecd72ebac88aab3a20d17b84ece78

SHA256
076cb45e87b0262b7f9e7b0f09aacba0a0dc2f23fafcff157c93600e11806367

SHA512
caeeb6cf73e06608ba2f55c101ef1a89137b59a29a7bdedb2834671fedc7ff2a3e58286a4390ea1cfa6492b31e6d68f81f4865f55951124eb0731c72bf4cedf6

Download Submit
memory/1756-0-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/2260-6-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download