6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 15:56

Target

f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
Size

1003KB
MD5

f62418e6f4cfa6b99e5cc3a8ccd7e5da
SHA1

b1b613925ff5d62ad08ee04f93552e6a1c4b0b3f
SHA256

6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3
SHA512

65730f5670cd53b56135f686aee55d06714bf66214277f9aa11df2c03919b2938b950e473b601b36b4fcae7e00ef6eae9ce11942c7b6b19db0cc554fe9aa35f6
SSDEEP

24576:qKeyxTAJj7P+yWw1S5osrRH8rxQM2uTSRjOT2rsrWgd9zLoMdB:qKeyRA0yz14rRH8X29cT24rWsAMH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2812	samscrqacmyrvy.exe

Loads dropped DLL 1 IoCs

pid	Process
2964	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jllz\samscrqacmyrvy.exe	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2812	2964	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2812	2964	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2812	2964	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2812	2964	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\jllz\samscrqacmyrvy.exe
  "C:\Program Files (x86)\jllz\samscrqacmyrvy.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

\Program Files (x86)\jllz\samscrqacmyrvy.exe

Filesize
1013KB

MD5
3a9f2860cb0d4e1aa4d26b1791740845

SHA1
9e7c0ef737b2da72668fd43a3a75c0a362ee0eed

SHA256
a8fe8f995ba05ec53f307f2a5d95b3a69d5744c8584d1866a10adc4ebdb03b23

SHA512
54d6318e96b94c25673432ef9abf78ade43a50885d3e3143828a0cb6b652c266a385b3b5582debcd308f5af9c4e722c5ad52ffec7ffd65ad595049c31b4f3e38

Download Submit
memory/2812-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2964-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2964-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2964-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download