cfa5c25df87b666482d134df4bd9c6c2054ff92672a055212e408ae18f0d101b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 18:27

Target

ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe
Size

135KB
MD5

ebb7750bc800c72a79a7aa22a4f26805
SHA1

067e613c61087535d9d49413c76f621637309830
SHA256

cfa5c25df87b666482d134df4bd9c6c2054ff92672a055212e408ae18f0d101b
SHA512

86768a2dc27485d609f8ffe9576faf7fc680f8d1ecc938ef227f9d6bafffc796b1a89d82d42db7d3ee03419a1403d86b1564d1e7f5f401944eab36caad949411
SSDEEP

1536:4SnWnZAH5YTJuIcntCRRp1jq9gBuQYnQw75h3vZxiCk3uENF3kUUejS:snOHLtCaQYQs5h3vPiVugF3rJG

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2296	2416	ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2296	2416	ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebb7750bc800c72a79a7aa22a4f26805_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\control.exe
  control.exe
  2⤵
  PID:2296

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2852