48f0b4a2b7bdcc3d4617176858e637c6c571cda9327f157bf6afbf020ff15f9e

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:37

Target

4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe
Size

114KB
MD5

4310cc61e116b5e77c2ee4f2e1cf19ba
SHA1

0c2189b8ba34f36b9c9ccac6fa16f70e80d5adc9
SHA256

48f0b4a2b7bdcc3d4617176858e637c6c571cda9327f157bf6afbf020ff15f9e
SHA512

7822690c52a34c2dd51fcdd18b50a18001e0bccf218a861ede702defcef9071bf3bbd6a57bffb743933212eb7dfa0724d30d47612ec2f0dff9fb1cb648332f49
SSDEEP

1536:MP6FtrQ2TF5WKexPxZRry1OQ67NcfAHrmp1wROSEkj7ZgqcVwdCaXI:MP6FtTF5WKeVxpzr1MSEytgq4eCaXI

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2656	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe.tmp

Loads dropped DLL 2 IoCs

pid	Process
1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe
1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe
1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe
1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2656	1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe	30
PID 1816 wrote to memory of 2656	1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe	30
PID 1816 wrote to memory of 2656	1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe	30
PID 1816 wrote to memory of 2656	1816	4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe.tmp
  C:\Users\Admin\AppData\Local\Temp\4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe.tmp
  2⤵
  - Executes dropped EXE
  PID:2656

\Users\Admin\AppData\Local\Temp\4310cc61e116b5e77c2ee4f2e1cf19ba_JaffaCakes118.exe.tmp

Filesize
82KB

MD5
7ded5248a50076b3d6a5cf44718ff242

SHA1
db13d048b5bd4d79f78e0574391361da793ad759

SHA256
802695c1cba1bab7aa0c3531b40d769587a925201aee4f7d58d85b99f4f7ff33

SHA512
76204b136ed0a3d58adab05a87bdd7be7a07de618480ac372546bea466dd551d04346344f03987a67838e558f60c8f2a2fc14fadb74a7219cbc4ef57d7988316

Download Submit
memory/2656-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download