c86e30f16b1ac71ceca11de872314ebfc2f697484ff340e817be6a015385a7c5

Analysis

max time kernel
82s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 19:37

Target

db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe
Size

7.2MB
MD5

db15f1ba72cd5ff7ecc6cf93c4cc0592
SHA1

36bd377e7dd73344f7f46e5b38435ec86c8d2df0
SHA256

c86e30f16b1ac71ceca11de872314ebfc2f697484ff340e817be6a015385a7c5
SHA512

e450c865141bfccd88572d318f17791662128360544aaedc29db8f56fc95881200b841e0b09151eaa7594460284146b2e87a2cecc44a9a36555bf3274ad3ac42
SSDEEP

196608:WtO+gp1DKI9onJ5hrZER96Q3jo4UR7+A3VU6KKbc5z8uA:DpNV9c5hlER96A2RSgmNic5Y

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2880	db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2880	1120	db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe	30
PID 1120 wrote to memory of 2880	1120	db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe	30
PID 1120 wrote to memory of 2880	1120	db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\db15f1ba72cd5ff7ecc6cf93c4cc0592_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:2880

C:\Users\Admin\AppData\Local\Temp\_MEI11202\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit