2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:00

Target

35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Size

932KB
MD5

35052f149100475f8307e1d04697ed32
SHA1

6aa986abbd9ee14710b34a4e631520d100cef8bb
SHA256

2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4
SHA512

54e293a74b90ffabb39cc015a17b55fa22d3e2cd0a898a68739eee6fc9488c8cebf9e05ff26f9dbcb2ba6d1e288c3a1ac09edf1375857f4f09b8a14aa5553bec
SSDEEP

12288:1Xmc2JMORj5NPrpGa9a1U53gbFm33WP34Hrk3ajUWm2mDj4nnmsEmS:B5qPPltA1UtF33WA9jUWm2mDjdH

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2176	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2176	2964	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2176	2964	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2176	2964	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2176	2964	35052f149100475f8307e1d04697ed32_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\qelizresa1.bat
  2⤵
  - Deletes itself
  PID:2176

C:\Users\Admin\AppData\Local\Temp\qelizresa1.bat

Filesize
239B

MD5
d6b1f5f225c4f1df127db0273ce51270

SHA1
ab06a820e723537d3e66bb92da194bc8cf17ad20

SHA256
f5730a8642942f7fdad29bdd9be7a5f11c43175c82bb3185b1d210ad6c7c4727

SHA512
bef9b0edd513fb5e3ebf64163d51e7a71d1caee20f0f566a8d1a204a73004bd4528cb166eb5243168752655d7196b7f7920bed51cbd625eeea626bf3d63c1b25

Download Submit
memory/2964-7-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2964-8-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download