33cee6d6c24efd80555f1f3fa4615555178143a5cb4b0d378a602a63b759603b

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 06:51

Target

03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe
Size

19KB
MD5

03ca2abed5c289ec7c58ec0f9bc4431d
SHA1

51c1a3acafd5fba2365bffd9b2c603faa96b3737
SHA256

33cee6d6c24efd80555f1f3fa4615555178143a5cb4b0d378a602a63b759603b
SHA512

96875328abf82de5e6a83b77bb6122bb9ad963b4765930e5f3e3f187fece248b514e29d413177968c9c8794a00609614edf6c0bab213c50ade3261e7cf1a2591
SSDEEP

384:VT3wwlz/VkdKXNisg8jMDE4SVk8iqSP5vjeubjbrPOq8LK3LQ40czRiTycNw30g:VPzdksNiDeMDyk8iqSxvSKjbrPOxu3vz

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1008	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gddh3i32.dll	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gddh3i32.dll	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HookHelp.sys	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gddh3i32.cfg	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4756	1008	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe	85
PID 1008 wrote to memory of 4756	1008	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe	85
PID 1008 wrote to memory of 4756	1008	03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\03ca2abed5c289ec7c58ec0f9bc4431d_JaffaCakes118.exe"
  2⤵
  PID:4756

C:\Windows\SysWOW64\gddh3i32.dll

Filesize
16KB

MD5
379585bfb9997e492125918a9ad91c98

SHA1
641b59f4d102b5c39c7634ee597be876e9226011

SHA256
3563ee67895e46b9ac857c0ec272dcc4a6a90b3121d5498c5e81c062326b6386

SHA512
ec5b34127e82f460440d878b90b7ba9e933d398d1f23540a0c5f458b863819fa41af803d369856c5b54661295c08fc18514986c111fcd55ee0a75ab7c8b17e67

Download Submit
memory/1008-8-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download
memory/1008-13-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download