c5a3c06a1ba939040616ed00baaa52590c122788e27014146af1f41a43a2fa9d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 00:37

Target

e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe
Size

144KB
MD5

e8cdf30233028ce8877e6352c89411b1
SHA1

5b5a3e88b05fefe3f8a66c1b39acb5b54cfb8ca2
SHA256

c5a3c06a1ba939040616ed00baaa52590c122788e27014146af1f41a43a2fa9d
SHA512

ebc4e8c928621f239db1f6b6fa8ef414172845764efd66952058f6320b37d229f7d84de30da7cb196ab4636c8ef91e186d882bfd6873ba90a8e11a1918399195
SSDEEP

3072:4pMyREddQErq7NAe5bDFWgyli61HroynoFBI8M5eGMjyUb:4pMyodQErqJBxJqi6JoFq8M5eGEys

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2648	mldmm.exe

Loads dropped DLL 2 IoCs

pid	Process
280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe
280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mldmm.exe	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mldmm.exe	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2952 set thread context of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 2952 wrote to memory of 280	2952	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	28
PID 280 wrote to memory of 2648	280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	29
PID 280 wrote to memory of 2648	280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	29
PID 280 wrote to memory of 2648	280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	29
PID 280 wrote to memory of 2648	280	e8cdf30233028ce8877e6352c89411b1_JaffaCakes118.exe	29

\Windows\SysWOW64\mldmm.exe

Filesize
144KB

MD5
e8cdf30233028ce8877e6352c89411b1

SHA1
5b5a3e88b05fefe3f8a66c1b39acb5b54cfb8ca2

SHA256
c5a3c06a1ba939040616ed00baaa52590c122788e27014146af1f41a43a2fa9d

SHA512
ebc4e8c928621f239db1f6b6fa8ef414172845764efd66952058f6320b37d229f7d84de30da7cb196ab4636c8ef91e186d882bfd6873ba90a8e11a1918399195

Download Submit
memory/280-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-10-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-11-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/280-22-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download