6c4c8cfd02098f6f3b43bcc9fbcadeeebacf6c2d0c9c6b8334c4ec1b120cefec

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 10:20

Target

a66704fa99111103386727ef5eee679d_JaffaCakes118.exe
Size

6.6MB
MD5

a66704fa99111103386727ef5eee679d
SHA1

7595e38bf1e39aba91813f341f3f012c25e4faf7
SHA256

6c4c8cfd02098f6f3b43bcc9fbcadeeebacf6c2d0c9c6b8334c4ec1b120cefec
SHA512

1e944ee55402da2161270e1946177b1183ffa12e22d924e568b9b2e2d11915635b96bee1434c922c0d6bf43526430dac7a834714f3d91c3c176ac2076877571e
SSDEEP

196608:GC+gp1DM9onJ5hrZER9xQ3jo4UQ7+wKIAFuD:7pNM9c5hlER9xA2QSXIA

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2976	a66704fa99111103386727ef5eee679d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2976	1520	a66704fa99111103386727ef5eee679d_JaffaCakes118.exe	31
PID 1520 wrote to memory of 2976	1520	a66704fa99111103386727ef5eee679d_JaffaCakes118.exe	31
PID 1520 wrote to memory of 2976	1520	a66704fa99111103386727ef5eee679d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\a66704fa99111103386727ef5eee679d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a66704fa99111103386727ef5eee679d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\a66704fa99111103386727ef5eee679d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a66704fa99111103386727ef5eee679d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2976

C:\Users\Admin\AppData\Local\Temp\_MEI15202\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit