6846559c306b42f3fd13d671e7a70be6beeb01281dc90a7fa295e55927fc5fa7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 09:52

Target

e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe
Size

1.1MB
MD5

e1dc77fdf88971dd3916c543e16f3f70
SHA1

6d5dd3d5594a4aa9f41837bad6766f6f9290cbde
SHA256

6846559c306b42f3fd13d671e7a70be6beeb01281dc90a7fa295e55927fc5fa7
SHA512

aec269152f978b714f8bdc2b3c0b3f091b0ae60f01f3bba14bd5731a6235e7240958e14e31bc9450b751af3d7e3e7644256491a1647ac3e37d5d77eae68153ad
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGPYEZmwDsV3CxEN5OWHku:dqgazxcGP4wD6CxCQ+ku

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2892	ajqdnoxwjxtknx.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\pdzuep\ajqdnoxwjxtknx.exe	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2892	1804	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	86
PID 1804 wrote to memory of 2892	1804	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	86
PID 1804 wrote to memory of 2892	1804	e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1dc77fdf88971dd3916c543e16f3f70_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\pdzuep\ajqdnoxwjxtknx.exe
  "C:\Program Files (x86)\pdzuep\ajqdnoxwjxtknx.exe"
  2⤵
  - Executes dropped EXE
  PID:2892

C:\Program Files (x86)\pdzuep\ajqdnoxwjxtknx.exe

Filesize
1.1MB

MD5
1b12ff4549dbd239977fca58cf58ca67

SHA1
05c679d3596a583689d3f628e39fb6e303e4a54d

SHA256
f7a3cb635489811d5ff043d38baa1553f2aba90cb04d7270d15e4415f8c506a8

SHA512
090f5c6ed370adfa7ba359451f72629409735c62e0858d744bf24edfa045ce11a9ecf78f9a0cbd29060864bf651c2bc48fc08f6581aad3dc316e74803b962660

Download Submit
memory/1804-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2892-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download