e58785d28ff2169a38dcca4c47e57d967cd3bfc508cb3e1dedd37a555c4bae2e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 08:23

Target

eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe
Size

139KB
MD5

eaa5246f9a9dc115d7939b7636b682cb
SHA1

e844b61abc99e82d5e9fa8f9febf61b2f895ed01
SHA256

e58785d28ff2169a38dcca4c47e57d967cd3bfc508cb3e1dedd37a555c4bae2e
SHA512

d5aabbb696ae5645fd81cb2fb15be67f22e0b45a91adb86beeebaae0386d6d0635960f9721471808d5f6a6c0f2393461875cfc8b59a333d25d1999d98e33bd85
SSDEEP

3072:3Dr7a0seyUpc3V0HzAhUkPiVpipJec/IMcK4i3JvGoXyE9xqH:3f7YeyUpc3VizWUkzwm4FB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28
PID 1624 wrote to memory of 2952	1624	eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eaa5246f9a9dc115d7939b7636b682cb_JaffaCakes118.exe -deleter
  2⤵
  PID:2952