7bc4d4f73fd3be7dc26641bbb0f1d9d256b492ff702b0e7de0ff3cc90a509f30

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 13:58

Target

b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe
Size

224KB
MD5

b3dc40004d7cf8fe1ffa7f61085002db
SHA1

ac3d23043d5f1e8985ef82fa224129b6b8979631
SHA256

7bc4d4f73fd3be7dc26641bbb0f1d9d256b492ff702b0e7de0ff3cc90a509f30
SHA512

c4710def5cbcd3a3f9a6984befbd6a93ac9846e3b39222e71fd9629a401b36a08fc8d22822764a2e8fe104792b68c1155d84d15c5a8f283e78c909d0ea308115
SSDEEP

3072:WM9jG0zeb+Bd7ljqaULpJKV/WxlX8sh+li7pBNi2VYCT8NbHyf+AViaO4V:WgzQ+D7ljXma/WxSTi7rT8xHY64V

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1932	wdscreatea.exe

Loads dropped DLL 2 IoCs

pid	Process
1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe
1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1932	1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1932	1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1932	1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1932	1912	b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b3dc40004d7cf8fe1ffa7f61085002db_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\wdscreatea.exe
  "C:\Users\Admin\AppData\Local\Temp\wdscreatea.exe"
  2⤵
  - Executes dropped EXE
  PID:1932

C:\Users\Admin\AppData\Local\Temp\wdscreatea.exe

Filesize
224KB

MD5
b3dc40004d7cf8fe1ffa7f61085002db

SHA1
ac3d23043d5f1e8985ef82fa224129b6b8979631

SHA256
7bc4d4f73fd3be7dc26641bbb0f1d9d256b492ff702b0e7de0ff3cc90a509f30

SHA512
c4710def5cbcd3a3f9a6984befbd6a93ac9846e3b39222e71fd9629a401b36a08fc8d22822764a2e8fe104792b68c1155d84d15c5a8f283e78c909d0ea308115

Download Submit
memory/1912-7-0x0000000000300000-0x000000000034A000-memory.dmp

Filesize
296KB

Download