3be2c77ecca108233ea3db3b2c245c6f4b11907eda8634dd783a934f82518e62

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:22

Target

46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe
Size

4.2MB
MD5

46ca51f29665af7c89f29703c33ffcac
SHA1

c67212584eaa8e095263f5e2db9c23bf7e3544c0
SHA256

3be2c77ecca108233ea3db3b2c245c6f4b11907eda8634dd783a934f82518e62
SHA512

9ecba4496d080934eb725b19364ad8e66acaeafb04eb1776b4471e144b1a8c690f5adb277922981342c00dfade29f443611af845245bc9653aab6f697de60be5
SSDEEP

98304:emhd1Urye9Jkk/Dh9nMzgA9pIVLUjH5oxFbxCVLUjH5oxFbx:elvfnM8A9WVUjZEdCVUjZEd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2060	9637.tmp

Loads dropped DLL 1 IoCs

pid	Process
2552	46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2060	2552	46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2060	2552	46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2060	2552	46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2060	2552	46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\9637.tmp
  "C:\Users\Admin\AppData\Local\Temp\9637.tmp" --splashC:\Users\Admin\AppData\Local\Temp\46ca51f29665af7c89f29703c33ffcac_JaffaCakes118.exe EBD0317E9515CCB3C8B18B7EEB6BCC218C20AE8A9408439A71BC8942B90C89BF80AA157D91E0AC4A782562CDCE90AAB8CAB1E8682EFD25A9E4FF4CCF0B20A827
  2⤵
  - Executes dropped EXE
  PID:2060

C:\Users\Admin\AppData\Local\Temp\9637.tmp

Filesize
4.2MB

MD5
05334c8fda81e399c3ccc40dbdecc34d

SHA1
20fcd8efd0e612f8edb821eecff03efa8b6949b8

SHA256
e155c60de0f2bbdf41355b2d0cf87b897b30232e004affa063a72236391ea705

SHA512
47ab4c4867bdfbd168fa83bd5ca16ab22e9d56531f26e5a9982512e6ca2526f03e1a80478a9e8ffe279ee991d15ee37edfa672498a8a31feeed82ce4922acc13

Download Submit
memory/2060-6-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2552-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download