1da13de2fea970749141cc8069f9082b2128b9af1518c2c50b91fb2c62480e6c

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 23:11

Target

3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe
Size

145KB
MD5

3f3f0205a6526fc87a23a4e123e55d55
SHA1

fd5e8fe61168ca4f0e7f0a8df0b581894df46bd3
SHA256

1da13de2fea970749141cc8069f9082b2128b9af1518c2c50b91fb2c62480e6c
SHA512

a8a235ecd93b669de89822d904cb62bf1d32323d17a5530b52a3c6283f9f40cf150a4fc7c12e231db064c08f37910a97882523a3868d05b502108c449fcedfd9
SSDEEP

3072:e5BvJyN8LR2/z0m1tZHEARuBJOJbnTj+uV54+z:eToN8o/zBzZHEAErOJbnHvj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
924	DaumCleans.exe

Loads dropped DLL 2 IoCs

pid	Process
2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe
2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 924	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	30
PID 2076 wrote to memory of 924	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	30
PID 2076 wrote to memory of 924	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	30
PID 2076 wrote to memory of 924	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2148	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2148	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2148	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2148	2076	3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2076
- \??\c:\tmp\DaumCleans.exe
  "c:\tmp\DaumCleans.exe"
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Users\Admin\AppData\Local\Temp\3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3f3f0205a6526fc87a23a4e123e55d55_JaffaCakes118.exe"
  2⤵
  PID:2148

\tmp\DaumCleans.exe

Filesize
30KB

MD5
4b483449dd5b86e9c39edd49a97abe77

SHA1
a973a4e4e488bed89072695798594642ef94bc64

SHA256
f3ed954f36b8982de337ced97c7b62b8eb2a0ede988ea11fad6193294ee0e5a0

SHA512
21fb00c2ee89026b3fdb4f4d55bdbd8a2f0087e16632468d17f994a277e664cb990dab02b8ec82b0be5f9887b400b7b985108adf8102d99879fed73151459cb1

Download Submit
memory/2076-9-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download
memory/2148-8-0x0000000000090000-0x00000000000B8000-memory.dmp

Filesize
160KB

Download