59a0516f19b97d929c8e221d946d3a7f2dad741dd8b44e9eb37e37721182fd2e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 17:36

Target

fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe
Size

854KB
MD5

fad2cfecdccab1cc13642fbaa1c8676e
SHA1

f29e08902e1dafda1ed613bb9aa1d0d5bd01f03a
SHA256

59a0516f19b97d929c8e221d946d3a7f2dad741dd8b44e9eb37e37721182fd2e
SHA512

a3ee598b8d564aab4c244a1e54caa9b9b3fb70595ca28d9a1525f78e24658aca0929fec8cd43fb8742bf035fb90fad46b4d372d1bb97dabc118d6c6fda780063
SSDEEP

24576:ylnjI9LmIUu6TVaML+TKWmA7xvRVQTAV8tX6jSa:ylY613JTq8tX6jR

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2916	2868	fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe	28
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30
PID 2916 wrote to memory of 1624	2916	Net.exe	30

C:\Users\Admin\AppData\Local\Temp\fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fad2cfecdccab1cc13642fbaa1c8676e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop PcaSvc
    3⤵
    PID:1624

memory/2868-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download