1c3323a190745c652bb481b2f51a0760de1ac2465968f4da2c2c01ec8fe87c15

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 06:33

Target

380f5654823b50db09659131e66085bd_JaffaCakes118.exe
Size

82KB
MD5

380f5654823b50db09659131e66085bd
SHA1

95684dccbc8832288ee3cab9ff6011945bcf13a0
SHA256

1c3323a190745c652bb481b2f51a0760de1ac2465968f4da2c2c01ec8fe87c15
SHA512

00713132c204ee7b658ed69f0dddc930f342f73ed179b9f6af237f95d5342dfab11c02a593832fda829cc0001f73b4f3e9d4394fb172cdbaafe9daf4c2f73394
SSDEEP

1536:oYNAe9+fi4I+3cR/hwF5CMSLI+iuduC+Shx/4GyQbVyU9MVCG:NutIZwFJSLI+icCOxwGyQ5yLJ

Score

7^/10

aspackv2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral1/files/0x0008000000016d07-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
748	P8J946KF567P8

Loads dropped DLL 1 IoCs

pid	Process
1928	380f5654823b50db09659131e66085bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 748	1928	380f5654823b50db09659131e66085bd_JaffaCakes118.exe	30
PID 1928 wrote to memory of 748	1928	380f5654823b50db09659131e66085bd_JaffaCakes118.exe	30
PID 1928 wrote to memory of 748	1928	380f5654823b50db09659131e66085bd_JaffaCakes118.exe	30
PID 1928 wrote to memory of 748	1928	380f5654823b50db09659131e66085bd_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\380f5654823b50db09659131e66085bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\380f5654823b50db09659131e66085bd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\P8J946KF567P8
  C:\Users\Admin\AppData\Local\Temp\P8J946KF567P8 "http://streamingporntv.com/inwm.data"
  2⤵
  - Executes dropped EXE
  PID:748

C:\Users\Admin\AppData\Local\Temp\P8J946KF567P8

Filesize
42KB

MD5
b04004007346f9551d61440a5f5f2649

SHA1
0f1de03cbea036d2b62092c589075e49f57c993c

SHA256
17b14b5526cab0d8cd2cfa99843cdbfca7d7d269a4ab49e8186d3926cf79d761

SHA512
a9b38b8f3536c566d1eb19da4a3d40501461285e262f9180e892094a19501029e76adefe9995e42bc1f318d7fd32fa64e466f3c2f77fec74391ab1188273c214

Download Submit
memory/748-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/748-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1928-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1928-11-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/1928-17-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download