6d20df56d07b385472243fdf4787f1a64a66f1b2a2328abe3b39d0a1b6666407

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 16:30

Target

e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe
Size

31KB
MD5

e7e7d4ccef2f87cf5999c2807c16019e
SHA1

cad2e3320da34106555c8d10903b2646c1981ab7
SHA256

6d20df56d07b385472243fdf4787f1a64a66f1b2a2328abe3b39d0a1b6666407
SHA512

324ea96b0dbac6379453b62602a8105db88432c85bcab1620b221b02b46975dc97e9be77bd3320a19815c314a477c356f8b37cfb7d0c5752ce9b2097cc88e50f
SSDEEP

768:Zih7TzTBziifTeiZSVWihwEknh0L7OTLeNfQf3:oZ/nEkh8OTKN6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe
2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1212	2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe	21
PID 2976 wrote to memory of 1212	2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe	21
PID 2976 wrote to memory of 1212	2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe	21
PID 2976 wrote to memory of 1212	2976	e7e7d4ccef2f87cf5999c2807c16019e_JaffaCakes118.exe	21

memory/1212-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1212-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2976-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2976-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2976-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download