82226a41831cd638a8dfc4a6beaf5503de209328d40d37387f1293fd6a63d1c1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:59

Target

37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe
Size

6.5MB
MD5

37c9bd593983a3c90b90a8dfee9ca0cb
SHA1

31b0b777b878bb8dc098c3dac07fca52367173d6
SHA256

82226a41831cd638a8dfc4a6beaf5503de209328d40d37387f1293fd6a63d1c1
SHA512

220f31e07e603b4493f274470de65dcfecaa85526435234c0a2a4495b8cfaa8cab2dfffe14558ceb72eff6acd46ea8b71898d2028619c55d4b4693fe9cb0f1ab
SSDEEP

196608:4eK+gp1DM9onJ5hrZER9xQ3jo4UR7+G4fcTK/uy5:ypNM9c5hlER9xA2RSGi/u

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2956	37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2956	3016	37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe	31
PID 3016 wrote to memory of 2956	3016	37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe	31
PID 3016 wrote to memory of 2956	3016	37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\37c9bd593983a3c90b90a8dfee9ca0cb_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2956

C:\Users\Admin\AppData\Local\Temp\_MEI30162\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit