1f8da13f9332c155ca90f61952056f2bed8f3a0841e436ff3573149fbe80eeb7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 05:55

Target

dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe
Size

932KB
MD5

dcf72cdbe3e79716399ea736a78497d3
SHA1

2113b0345bd20388521adf0f29d5dd99c6d15ef2
SHA256

1f8da13f9332c155ca90f61952056f2bed8f3a0841e436ff3573149fbe80eeb7
SHA512

153a2dcdc66e6cf0862ad75d6ec825611a44d5af8bf0d5df1ef63ec56372a7fd0aa6accd537e8a81cc96bc3ba9bee97f32713213adcde8de1a7acbe38c1dc3b9
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuG1rnLTZT9HVcUy:dqgazxcG1DL/HKUy

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1448	bvrgvddkiviw.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\yyksl\bvrgvddkiviw.exe	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1448	2696	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe	28
PID 2696 wrote to memory of 1448	2696	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe	28
PID 2696 wrote to memory of 1448	2696	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe	28
PID 2696 wrote to memory of 1448	2696	dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcf72cdbe3e79716399ea736a78497d3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\yyksl\bvrgvddkiviw.exe
  "C:\Program Files (x86)\yyksl\bvrgvddkiviw.exe"
  2⤵
  - Executes dropped EXE
  PID:1448

\Program Files (x86)\yyksl\bvrgvddkiviw.exe

Filesize
950KB

MD5
af0130e7450e74fa60f258e5df22f54b

SHA1
b3c018582331e74c78c3f203996619be8a23f3cb

SHA256
bd780082a7d7c917ea98973c1030e219a0ccd45b86a2c421497c52978ea45ccc

SHA512
d339386d559822e0c81f5761f16cdbdc5ce8472d2000c8d159fab24a63483da98546e2a36a674c47cbd257692aeb6c5cc33a2791d21b44806c847e869505e887

Download Submit
memory/1448-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2696-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download