4827c1bdf5000cc8fc280fa631d36c752d0cdd7b0b357671ef1ebc46a11c440f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 01:33

Target

f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe
Size

685KB
MD5

f935b6c7f24be477a23044fa9a9dc9a5
SHA1

e67fb9bcf9975e0c6c4122ec7b25e61de6d1ba24
SHA256

4827c1bdf5000cc8fc280fa631d36c752d0cdd7b0b357671ef1ebc46a11c440f
SHA512

4b9587402b0f2e99af2aeec67307db55c0323228b8e863506f52b7d8d612aa3fdef4104ded5f5adbff7c546a2e91f558c45080f45b80fbf51ee98baeefc9dd34
SSDEEP

12288:8Bszn2zd6HX+qs+WWhRmmXikb0iTvDcicTB4vs8w:2mnAd6OqszYRmsXb0iTrcVyvs8w

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe

pid process

2384 f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe

pid	process
2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe

description	pid	process	target process
PID 2384 wrote to memory of 356	2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe	MSBuild.exe
PID 2384 wrote to memory of 356	2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe	MSBuild.exe
PID 2384 wrote to memory of 356	2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe	MSBuild.exe
PID 2384 wrote to memory of 356	2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe	MSBuild.exe
PID 2384 wrote to memory of 356	2384	f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\f935b6c7f24be477a23044fa9a9dc9a5_JaffaCakes118.exe"
2⤵
PID:356

memory/2384-1-0x0000000000190000-0x0000000000290000-memory.dmp

Filesize
1024KB

Download
memory/2384-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download