0057d82a79174aac5382c802a63310dedc2c2ce6f06b3119b52fcad8304089a8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 00:26

Target

2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe
Size

144KB
MD5

2400fb736f5a577d1543f528b624ff56
SHA1

db7bb0984d55e1857ed6ad0387d42554d1d753b4
SHA256

0057d82a79174aac5382c802a63310dedc2c2ce6f06b3119b52fcad8304089a8
SHA512

cd8f3770fc64ee661fe16162873a9e3e1e75353a26e62f617c8b275d3700d9e6e3f9d69e898aea75e830a8b30347aeaf02046f43ccf8ae011d36fce1022bbf2e
SSDEEP

1536:7jehTVZo4fKVUAiGHCPc2UMoEZoSo8yI:7yRo4fKVUA5CmMoEZos

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2648	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	cmd.exe
2520	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\smss.exe	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe
File created	C:\Windows\system32\LogFiles\smss.exe	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2520	2872	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2520	2872	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2520	2872	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2520	2872	2400fb736f5a577d1543f528b624ff56_JaffaCakes118.exe	28
PID 2520 wrote to memory of 2648	2520	cmd.exe	30
PID 2520 wrote to memory of 2648	2520	cmd.exe	30
PID 2520 wrote to memory of 2648	2520	cmd.exe	30
PID 2520 wrote to memory of 2648	2520	cmd.exe	30

C:\Windows\System32\LogFiles\smss.exe

Filesize
144KB

MD5
2400fb736f5a577d1543f528b624ff56

SHA1
db7bb0984d55e1857ed6ad0387d42554d1d753b4

SHA256
0057d82a79174aac5382c802a63310dedc2c2ce6f06b3119b52fcad8304089a8

SHA512
cd8f3770fc64ee661fe16162873a9e3e1e75353a26e62f617c8b275d3700d9e6e3f9d69e898aea75e830a8b30347aeaf02046f43ccf8ae011d36fce1022bbf2e

Download Submit
memory/2520-18-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download
memory/2520-17-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download
memory/2648-19-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download
memory/2648-20-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download
memory/2872-11-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download
memory/2872-12-0x0000000014000000-0x0000000014025000-memory.dmp

Filesize
148KB

Download