660d68ee092d2778b0e979e0c7931c7ac7c074d2ed676ef1b53d6912a788a365

Analysis

max time kernel
9s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:38

Target

2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe
Size

6.5MB
MD5

2b2b4eae993704fd355b1b3663674b9e
SHA1

b201920219f53c7d8840e79180b499f9af671170
SHA256

660d68ee092d2778b0e979e0c7931c7ac7c074d2ed676ef1b53d6912a788a365
SHA512

cfeea5fae3cbbaeb5308346e16614c5b2cfac5cc6ac851f3894a92da58693f8281c2f6c74f7a0fcd78de8a4039c2d31c3c385e2e4d03ffb80d1a8bcee2f94959
SSDEEP

196608:no+gp1DM9onJ5hrZER9xQ3jo4UR7+pCL6S:YpNM9c5hlER9xA2RSpC

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2872	2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2872	2548	2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe	30
PID 2548 wrote to memory of 2872	2548	2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe	30
PID 2548 wrote to memory of 2872	2548	2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2b2b4eae993704fd355b1b3663674b9e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2872

C:\Users\Admin\AppData\Local\Temp\_MEI25482\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit