467a7f33307bfe186fdf7232b176739c6716bab74d1f097abb1403db4bd9e5ac

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:08

Target

488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe
Size

6.9MB
MD5

488be57ec69574fc3f6e652bccb4564b
SHA1

ae485696a1d78f534fcfbd57c8fca59c48fd99ea
SHA256

467a7f33307bfe186fdf7232b176739c6716bab74d1f097abb1403db4bd9e5ac
SHA512

f10b448cd8563f2bb53b184d492f32200decc0f6161683dc373a34ac643629d5e8e073a68c85acab982a7310c0056c8f4cd6cf637d8c6c9dd1d52406c421e32f
SSDEEP

196608:qt+gp1D+Dez9onJ5hrZER9xQ3jo4UR7+oPosA:ypNSez9c5hlER9xA2RSoP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2372	488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2372	2792	488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2372	2792	488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe	31
PID 2792 wrote to memory of 2372	2792	488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\488be57ec69574fc3f6e652bccb4564b_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2372

C:\Users\Admin\AppData\Local\Temp\_MEI27922\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit