6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 15:56

Target

f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
Size

1003KB
MD5

f62418e6f4cfa6b99e5cc3a8ccd7e5da
SHA1

b1b613925ff5d62ad08ee04f93552e6a1c4b0b3f
SHA256

6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3
SHA512

65730f5670cd53b56135f686aee55d06714bf66214277f9aa11df2c03919b2938b950e473b601b36b4fcae7e00ef6eae9ce11942c7b6b19db0cc554fe9aa35f6
SSDEEP

24576:qKeyxTAJj7P+yWw1S5osrRH8rxQM2uTSRjOT2rsrWgd9zLoMdB:qKeyRA0yz14rRH8X29cT24rWsAMH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2300	uorgurfor.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\owhyyild\uorgurfor.exe	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2300	4516	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	87
PID 4516 wrote to memory of 2300	4516	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	87
PID 4516 wrote to memory of 2300	4516	f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\owhyyild\uorgurfor.exe
  "C:\Program Files (x86)\owhyyild\uorgurfor.exe"
  2⤵
  - Executes dropped EXE
  PID:2300

C:\Program Files (x86)\owhyyild\uorgurfor.exe

Filesize
1012KB

MD5
39c8d29735d62c4285d5e10ac5eaee61

SHA1
a563fedab4f83c0f891f10c9782bd484ab3294fa

SHA256
39c92b91665e9ea941e33f3a97b773945fd56f0d53b0c95e79be90e4c6e35b33

SHA512
fc53fc382cb2e0a729324b521afc6f35663a0c3a628b7dbe77ea94c7d21d0acd3849801a6a1751c7d5497ebe9045c287b3da138065108a69b3fe6c819175a1a4

Download Submit
memory/2300-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2300-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2300-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4516-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4516-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4516-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download