dd907b46cf2d625b65e49da7a1e4d9463e861f637ec65f44c1dfc2c2136ef817

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 08:50

Target

e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe
Size

549KB
MD5

e083ed18f76d0272d7a76462c138da14
SHA1

ef97652f02bcef38df0829decb60c423461b13d5
SHA256

dd907b46cf2d625b65e49da7a1e4d9463e861f637ec65f44c1dfc2c2136ef817
SHA512

a0b01464e3c1bd7fc5700e72e5ae277ad3133da7722fba19930b237c0c534ae32a00ea91b3fca39d63a420990330ba3b43d4214fba17e09887c8b00255d5ddba
SSDEEP

12288:WET7enAVM5Yjg8Bf+X8e43+zKIElOQbyPY1y3Vde6Dh0vA:WpnhCgKeyw4lRN1+Vde2h0Y

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4552	ha.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aemr\ha.exe	e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4552	4112	e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe	85
PID 4112 wrote to memory of 4552	4112	e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe	85
PID 4112 wrote to memory of 4552	4112	e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e083ed18f76d0272d7a76462c138da14_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\aemr\ha.exe
  "C:\Program Files (x86)\aemr\ha.exe"
  2⤵
  - Executes dropped EXE
  PID:4552

C:\Program Files (x86)\aemr\ha.exe

Filesize
558KB

MD5
a79f19b2af4852abb547898a84a63111

SHA1
cb27614f45b78c75354bd21b9fdb38e4b0b621e0

SHA256
ecbb9051c249280aea86524b66ee063f983feeb75800247215fbcf7ec45e7aea

SHA512
bc80b814c672b6b354315ca323d125c1ed0d3bc6cb85a8b1c35bf380634047a2f3d8164d6ec0d700949237fae8af88bdcb795e9cbed4df78a7021b48b4e73143

Download Submit
memory/4112-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4112-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4112-5-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4552-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/4552-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download