1548ffe73ff1b47a40871ebbef1632505de9e2720f45513859247d22bf254819

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 12:07

Target

f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe
Size

160KB
MD5

f5bb780944b82d9143a47ddf8df3d095
SHA1

7bc5c5fb0897c52ca11dabadf26b903f30b1679a
SHA256

1548ffe73ff1b47a40871ebbef1632505de9e2720f45513859247d22bf254819
SHA512

7edbc97c5640cf0ba471d3142d5ed2b81868121e56c5e245151000cb482bb197172cd821ac1f5983217886ee74105f049771cc64f8b6c0236799086b9e73f300
SSDEEP

3072:snDV6Qz11WQFvYGnJd6KpZV3uTN9WU/G9B32w590KqQbZzALbvl6:uQQaQFvYGJd6KpZV3uTN9WU/G9BGw59q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2504	1876	f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe	28
PID 1876 wrote to memory of 2504	1876	f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe	28
PID 1876 wrote to memory of 2504	1876	f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5bb780944b82d9143a47ddf8df3d095_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:2504

memory/1876-0-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/1876-1-0x0000000001D20000-0x0000000001DA0000-memory.dmp

Filesize
512KB

Download
memory/1876-2-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/1876-4-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/1876-5-0x0000000001D20000-0x0000000001DA0000-memory.dmp

Filesize
512KB

Download
memory/2504-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download