6846559c306b42f3fd13d671e7a70be6beeb01281dc90a7fa295e55927fc5fa7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 09:52

Target

e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe
Size

1.1MB
MD5

e1dc77fdf88971dd3916c543e16f3f70
SHA1

6d5dd3d5594a4aa9f41837bad6766f6f9290cbde
SHA256

6846559c306b42f3fd13d671e7a70be6beeb01281dc90a7fa295e55927fc5fa7
SHA512

aec269152f978b714f8bdc2b3c0b3f091b0ae60f01f3bba14bd5731a6235e7240958e14e31bc9450b751af3d7e3e7644256491a1647ac3e37d5d77eae68153ad
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGPYEZmwDsV3CxEN5OWHku:dqgazxcGP4wD6CxCQ+ku

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2368	swviewjx.exe

Loads dropped DLL 1 IoCs

pid	Process
856	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fpjfu\swviewjx.exe	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2368	856	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	28
PID 856 wrote to memory of 2368	856	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	28
PID 856 wrote to memory of 2368	856	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	28
PID 856 wrote to memory of 2368	856	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\fpjfu\swviewjx.exe
  "C:\Program Files (x86)\fpjfu\swviewjx.exe"
  2⤵
  - Executes dropped EXE
  PID:2368

C:\Program Files (x86)\fpjfu\swviewjx.exe

Filesize
1.1MB

MD5
a5d623fc9a8b4e70e12599199b7fe763

SHA1
7e59d1037df979e851d89c4f95734f0486cc0248

SHA256
c6e5e6af5450be292da165170d63dde79fab8dac09d1230fdc3959702dc5068b

SHA512
3cb956048f01dca4ce2e947bfbb45bb0b9376519fda4e54bb5890a3765a98389cd0cebf96ce37b89ef46e0da32111b92cc9005a844660dbf8bf871ce062bad03

Download Submit
memory/856-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2368-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download