27dfb7250112e2a7db7c743afbd3cd86bf15904952e8a3af3c859818bf451e7a

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 20:01

Target

6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe
Size

11KB
MD5

6132f8bfc4b76eb4a194a146a0956696
SHA1

4423ddf1e039e99ffecb4e55d9a48b8215588b86
SHA256

27dfb7250112e2a7db7c743afbd3cd86bf15904952e8a3af3c859818bf451e7a
SHA512

daf058baec7beb5f67819ed43225fb8ad9f0b79b90e481a6f6028fc216a867e1c41f296dc90818a10c0914a81683a16196c6e91f4c0ebb77cb39587ba169613b
SSDEEP

192:g99SVW9+gQqPPKlfeUVJozoGPvebjdAASaP4FlgSeXaekczul/:Y9SU9gqPPKvo08mlSaPalg3K8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2056	mgrs.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mgrs.exe	6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2056	2416	6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2056	2416	6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2056	2416	6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2056	2416	6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6132f8bfc4b76eb4a194a146a0956696_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\mgrs.exe
  C:\Windows\mgrs.exe
  2⤵
  - Executes dropped EXE
  PID:2056

C:\Windows\mgrs.exe

Filesize
11KB

MD5
6132f8bfc4b76eb4a194a146a0956696

SHA1
4423ddf1e039e99ffecb4e55d9a48b8215588b86

SHA256
27dfb7250112e2a7db7c743afbd3cd86bf15904952e8a3af3c859818bf451e7a

SHA512
daf058baec7beb5f67819ed43225fb8ad9f0b79b90e481a6f6028fc216a867e1c41f296dc90818a10c0914a81683a16196c6e91f4c0ebb77cb39587ba169613b

Download Submit
memory/2056-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2056-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2056-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2056-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2416-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2416-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2416-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2416-10-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/2416-8-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download