42e6a9531d3f5791c71b39f390ec2dbabba6e7ba69c0d384905cc2f84de2d455

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 07:55

Target

1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe
Size

32KB
MD5

1cc334d6973ac112c643d594592f6789
SHA1

0cd17d0a796abc71e9eeac5325f178a56f8f42e3
SHA256

42e6a9531d3f5791c71b39f390ec2dbabba6e7ba69c0d384905cc2f84de2d455
SHA512

c38c84e4cb5bceb9c2461a352c6e12a1c10ca9efc4ce8079f37cfd023d8464d495347a6789d153736f69edef7645526b4c427a2ea96535581a9dc417e7c44d82
SSDEEP

768:xPrCXibnfts+yJAloJB9KFplCGRWunldTV:FrCXibfyHAloJyjlCGpj

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1756	2796	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	28
PID 2796 wrote to memory of 1756	2796	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	28
PID 2796 wrote to memory of 1756	2796	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	28
PID 2796 wrote to memory of 1756	2796	1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1cc334d6973ac112c643d594592f6789_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "/sihost32"
  2⤵
  PID:1756

memory/1756-0-0x0000000000060000-0x0000000000067000-memory.dmp

Filesize
28KB

Download
memory/1756-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/1756-3-0x000000001ADA0000-0x000000001AE20000-memory.dmp

Filesize
512KB

Download
memory/1756-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1756-5-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download