5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 12:16

Target

f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe
Size

476KB
MD5

f5bf7345faf95d1997b4db8d72018a62
SHA1

9ec869cb94d730926ac5bd94ee0724e5bb8a94eb
SHA256

5d3e5503103fe87851128da37f39fdc2e500d7bbf9f69e681745e582db9450a5
SHA512

7ad9c11158402a42d6b601cf467b2d0093439d9aae85fc3eab9f5f631ec1398298b2c7b10b9be6a7b88d0f9a41e16e99de1f6403b4dd2f0a4ed64b908b1de302
SSDEEP

6144:dYKujIJ6lseq61sv7hN5wvEQui1h3svMzO4b3ymjT2hJjXTF+jPlMqhxD6joq:d1NJ6oAsyvELg3sje2autn

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1648	f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1392	1648	f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe	28
PID 1648 wrote to memory of 1392	1648	f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe	28
PID 1648 wrote to memory of 1392	1648	f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe	28
PID 1648 wrote to memory of 1392	1648	f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5bf7345faf95d1997b4db8d72018a62_JaffaCakes118.exe"
  2⤵
  PID:1392

memory/1648-1-0x00000000001E0000-0x00000000002E0000-memory.dmp

Filesize
1024KB

Download
memory/1648-2-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download