170c923d96ed548459d6af2615d4c069c59497a973bb6150f2fa543ad35bd9e1

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:25

Target

5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe
Size

6.6MB
MD5

5aa1c71de3146533fb253eec53d5eb3e
SHA1

34d00bf2c30323a340d5bd7079e2db3ced154603
SHA256

170c923d96ed548459d6af2615d4c069c59497a973bb6150f2fa543ad35bd9e1
SHA512

a109da1bfc2c761ae823bb0434552f4e87f67b161c2c465f3d84c674bcb4c99f43ab8c09fb601d20656cf7097cdbee932958a40c1856255db4ae769a6641a1e4
SSDEEP

196608:JFObpXXAe+gp1DD9onJ5hrZER9xQ3jo4UR7+uBP/J:KpND9c5hlER9xA2RSuB

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1976	5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1976	2872	5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe	31
PID 2872 wrote to memory of 1976	2872	5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe	31
PID 2872 wrote to memory of 1976	2872	5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5aa1c71de3146533fb253eec53d5eb3e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:1976

C:\Users\Admin\AppData\Local\Temp\_MEI28722\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit