1186b80c7963442214ce588f867f1d8cbea475ea3a369438777be129fa558381

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 06:59

Target

3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe
Size

1.1MB
MD5

3821b1993799b3c4135e980e93db2801
SHA1

e505f9743c0a718db865aa384f2cbdaae90dfe75
SHA256

1186b80c7963442214ce588f867f1d8cbea475ea3a369438777be129fa558381
SHA512

2fd95d66007cf7f713766efd431a294a2dc97e7d9761a419a7f4d560e5012c96437d7543826b1cb7da9395ea6ece6e99f6d54752559acb07c98b3c5787e8531c
SSDEEP

24576:a7hEUdQGwXTZz7Ti9aSSDqKbrYmDdgKGVt4b10Evi75:8hZ72TZz7MRSDqgUm0t4aTV

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2228	3821b1993799b3c4135e980e93db2801_JaffaCakes118.tmp

Loads dropped DLL 3 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2228	3821b1993799b3c4135e980e93db2801_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2228	2292	3821b1993799b3c4135e980e93db2801_JaffaCakes118.exe	31

\Users\Admin\AppData\Local\Temp\is-3QGOJ.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-GJFK1.tmp\3821b1993799b3c4135e980e93db2801_JaffaCakes118.tmp

Filesize
1.1MB

MD5
713bfb93270414f034fa70496d5cfffc

SHA1
f6b5e6a6d7ec32a1d32bbab37986da0cf1bc94c6

SHA256
8f7c04c54c61b7f11d3c6016254abaab89997cb0d5198e8c7ef0df2edbca16d7

SHA512
e9cfbc676e02854821cbd585d3de2b3f5cadf2c11fe306244cbba7ae066574dbfc7971f0e6a1d38a6e47af75762f608a8f14082d0e2f8d7c224c591caed00472

Download Submit
memory/2228-11-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2228-17-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2292-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/2292-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2292-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download