a426b0a9aa236c71846768c6e8b99d9d08097eb724f8732de6cc98079e5b18b3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 00:19

Target

c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe
Size

1.1MB
MD5

c5b950c783d213435b9f40162a2ec741
SHA1

8199254097247a504083209cfb08301a6de1533b
SHA256

a426b0a9aa236c71846768c6e8b99d9d08097eb724f8732de6cc98079e5b18b3
SHA512

290b46e2e624d6c5e320db7f496895be10f26b268e8ef7ea5cda0072d7423851d4b67cc622ff0f16ec050db9445a5822aff889225efe66805d165dc43b741d4e
SSDEEP

24576:qKeyxTAJj7P+yW6mc1YCwuv6ez8qufz/QQ49Fcx2jD0RQvWLo:qKeyRA0y9fWCw28lzYQh2Mavz

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
380	dlbkiygsmjega.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\emusf\dlbkiygsmjega.exe	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 380	2292	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe	28
PID 2292 wrote to memory of 380	2292	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe	28
PID 2292 wrote to memory of 380	2292	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe	28
PID 2292 wrote to memory of 380	2292	c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5b950c783d213435b9f40162a2ec741_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\emusf\dlbkiygsmjega.exe
  "C:\Program Files (x86)\emusf\dlbkiygsmjega.exe"
  2⤵
  - Executes dropped EXE
  PID:380

\Program Files (x86)\emusf\dlbkiygsmjega.exe

Filesize
1.1MB

MD5
9167a65293389f7df4edb835113fe902

SHA1
7382f8bfd3c23d3cec7b619cbba385438d4971ae

SHA256
9a5f954ff68d6bb22d6a81803c6842fe6662a1f82626e63a1f693ba6ad235771

SHA512
6b6c784ead5e60ad0b263019989d8be04c1a4e2b821adc43c4f7790fcdbe810cb846d9fc6d8b453800fa2ba69715ce7c65dc21d3ff058aef3c0be6604d561152

Download Submit
memory/380-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/380-11-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2292-5-0x0000000001E30000-0x0000000001EC4000-memory.dmp

Filesize
592KB

Download