7002c54c1425d85fc7574ac718272076178852668c70400afcb903c83a0375db

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 13:05

Target

f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
Size

707KB
MD5

f11f4b77e753d376fdc2526d88e15e74
SHA1

451b78624055a94f5390b6c1d5772bc8ffe3f061
SHA256

7002c54c1425d85fc7574ac718272076178852668c70400afcb903c83a0375db
SHA512

715e1146a9761df7ec2fe0171f46002e7feaa496ae46e0ffd9213cf27ceba7b8c7b40fd870707117ac740a78f3d96bd4030071c3128500321acfb15b0b42fb99
SSDEEP

12288:0xEVBEu4+lz5y/GazAH8yX3dz5R0NVeaHWEORU:nVK4yfzAPndFR0N4aUu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	svchost.exe
2524	svchost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2524	2972	f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe	28
PID 2524 wrote to memory of 1176	2524	svchost.exe	20
PID 2524 wrote to memory of 1176	2524	svchost.exe	20
PID 2524 wrote to memory of 1176	2524	svchost.exe	20
PID 2524 wrote to memory of 1176	2524	svchost.exe	20
PID 2524 wrote to memory of 1176	2524	svchost.exe	20
PID 2524 wrote to memory of 1248	2524	svchost.exe	21
PID 2524 wrote to memory of 1248	2524	svchost.exe	21
PID 2524 wrote to memory of 1248	2524	svchost.exe	21
PID 2524 wrote to memory of 1248	2524	svchost.exe	21
PID 2524 wrote to memory of 1248	2524	svchost.exe	21

memory/1176-25-0x00000000002C0000-0x00000000002E1000-memory.dmp

Filesize
132KB

Download
memory/1176-36-0x0000000001EE0000-0x0000000001EE2000-memory.dmp

Filesize
8KB

Download
memory/1176-30-0x0000000001EF0000-0x0000000001EFA000-memory.dmp

Filesize
40KB

Download
memory/1176-28-0x0000000001EF0000-0x0000000001EFA000-memory.dmp

Filesize
40KB

Download
memory/1176-26-0x0000000001EE0000-0x0000000001EE2000-memory.dmp

Filesize
8KB

Download
memory/1248-47-0x0000000002D80000-0x0000000002D82000-memory.dmp

Filesize
8KB

Download
memory/1248-41-0x0000000002D90000-0x0000000002D9A000-memory.dmp

Filesize
40KB

Download
memory/2524-16-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download
memory/2524-17-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download
memory/2524-18-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download
memory/2524-2-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download
memory/2972-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2972-14-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2972-6-0x0000000077110000-0x0000000077111000-memory.dmp

Filesize
4KB

Download
memory/2972-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download