7eab61dcb8a846711b171f33ae507e8546f84c16e626520b17260bdfd5f042e1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 18:26

Target

1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
Size

2.4MB
MD5

1c0ba2f64e0e3787adf106f27f7b728c
SHA1

f37a7824899d432330f2bf214e96fa48b9fdce31
SHA256

7eab61dcb8a846711b171f33ae507e8546f84c16e626520b17260bdfd5f042e1
SHA512

1a98cb23e211376f3cf9b72a2e3bb32d5c996ce695e2b7e5ade7b0f12f8ee109e53804e13aeb6e96a1fc177dddb48e256faa89d592fd708663d6e3bd3db9a462
SSDEEP

49152:dqgazxcGYN139lnk30ray05H8/cI83YeEgytVle:dqgazxc5H39ln2Ny0WmYdJt/e

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
320	vbojssatzdxav.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 320	1436	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	81
PID 1436 wrote to memory of 320	1436	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	81
PID 1436 wrote to memory of 320	1436	1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c0ba2f64e0e3787adf106f27f7b728c_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe
  "C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe"
  2⤵
  - Executes dropped EXE
  PID:320

C:\Program Files (x86)\lzlimg\vbojssatzdxav.exe

Filesize
2.4MB

MD5
1e8267c0764bb03b23261fc8c7d4174f

SHA1
8e91f2a5fe05baa0375c92f58461adb24bbc3322

SHA256
cea387dab05eb23d5e1f59e55263aed96beb184eb9d2acc175f912df4c74d690

SHA512
9c1a9550c47d7c3094aec89f73ce90f9ed162d9dd9c6e41fc10b899469a30140811352672895fae9b95870fe1800162543639c99efc0638dab83417043891971

Download Submit
memory/320-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1436-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download