e0030fd6edd2def92887e072301e34e5b37cff56ad804a008aea04e2c8fd9960

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 12:03

Target

079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe
Size

224KB
MD5

079e8acffe3c638e767635cb1f0fb996
SHA1

410cf957472e28f765e98e3ebc6dc6f181000e96
SHA256

e0030fd6edd2def92887e072301e34e5b37cff56ad804a008aea04e2c8fd9960
SHA512

be1c664a616418f0b0d6de0f13951038c954e42f9067f2c246b56239aa883c886846ebf8a2d14f4d4260dbeb4fa76f52efb71dfebe94bd08a523227ac3a98fa2
SSDEEP

3072:VM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AViaO4Vl:VgzQ+D7ljXma/WxSTi7rT8xHY64Vl

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1264	dialoff.exe

Loads dropped DLL 2 IoCs

pid	Process
2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe
2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1264	2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe	28
PID 2340 wrote to memory of 1264	2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe	28
PID 2340 wrote to memory of 1264	2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe	28
PID 2340 wrote to memory of 1264	2340	079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\079e8acffe3c638e767635cb1f0fb996_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\dialoff.exe
  "C:\Users\Admin\AppData\Local\Temp\dialoff.exe"
  2⤵
  - Executes dropped EXE
  PID:1264

\Users\Admin\AppData\Local\Temp\dialoff.exe

Filesize
224KB

MD5
079e8acffe3c638e767635cb1f0fb996

SHA1
410cf957472e28f765e98e3ebc6dc6f181000e96

SHA256
e0030fd6edd2def92887e072301e34e5b37cff56ad804a008aea04e2c8fd9960

SHA512
be1c664a616418f0b0d6de0f13951038c954e42f9067f2c246b56239aa883c886846ebf8a2d14f4d4260dbeb4fa76f52efb71dfebe94bd08a523227ac3a98fa2

Download Submit
memory/2340-7-0x0000000000EE0000-0x0000000000F2A000-memory.dmp

Filesize
296KB

Download