ec1a5fbd6a5ca09382dd4b71f473657eba1a4a6e0982bcd01697821ca24d84f9

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 08:17

Target

dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe
Size

30KB
MD5

dfd9612cb55b1cfc4a33d9fdaf8ed070
SHA1

5da6d9f8e4962eb7ea17e869ee5b586101b002c3
SHA256

ec1a5fbd6a5ca09382dd4b71f473657eba1a4a6e0982bcd01697821ca24d84f9
SHA512

d8173f7931f90d4748bd0fcafe42cf9c447557eefde5ab5fbd93d5ec276d1f357f284131d00848ee004b8417b365eb0c6b08e5c48e4fa400a75bc249b4f64160
SSDEEP

768:ERamfeaO55OIzv6ZrHwPZB65U7Y+7vZc5tunV7KYhJ:Lmi5OI76RHwPb61ov/nV7KmJ

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe

description	pid	process	target process
PID 3028 wrote to memory of 2196	3028	dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe	dw20.exe
PID 3028 wrote to memory of 2196	3028	dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe	dw20.exe
PID 3028 wrote to memory of 2196	3028	dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe	dw20.exe
PID 3028 wrote to memory of 2196	3028	dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:2196

memory/2196-3-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/2196-6-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/3028-2-0x0000000000110000-0x0000000000150000-memory.dmp

Filesize
256KB

Download
memory/3028-1-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-0-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-4-0x0000000074090000-0x000000007463B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-5-0x0000000000110000-0x0000000000150000-memory.dmp

Filesize
256KB

Download