aaa7d5158ad65b40d4186318baa32cd5a5a0e745a9007c77481860cb8b556779

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:25

Target

81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe
Size

8.0MB
MD5

81c77ff3bf709c432f57bdeae579f686
SHA1

1c892c3272ecd1f90c72032905b012918e5070f9
SHA256

aaa7d5158ad65b40d4186318baa32cd5a5a0e745a9007c77481860cb8b556779
SHA512

54b1f0eb8256db3a0736e0e3d86ac8e9186f855b05c62280bf79ba0da18d6b031ad4717db5478b9242867070bb79d0ae0b5348b5c7c6dfcf20f44c7a3409c50e
SSDEEP

196608:Ks+gp1Dw9onJ5hrZER5xQ3jo4UR7+EPpVITM9cMkK0fj:jpNw9c5hlER5xA2RSEbl9cT

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2780	81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2780	756	81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe	30
PID 756 wrote to memory of 2780	756	81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe	30
PID 756 wrote to memory of 2780	756	81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\81c77ff3bf709c432f57bdeae579f686_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2780

C:\Users\Admin\AppData\Local\Temp\_MEI7562\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit