067fd565b9f71d69f4b16d4ac1d2b0a1c41c090a194a88d3b573daf26cb4cb95

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 05:34

Target

047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
Size

564KB
MD5

047ae3338e5226b5283930c8acada287
SHA1

3a61453c1a938d226d6b9e0b3ed8c8c0b17416f1
SHA256

067fd565b9f71d69f4b16d4ac1d2b0a1c41c090a194a88d3b573daf26cb4cb95
SHA512

cf54a569f0adbf2a4b4b7f5140d7dd06f5fa019b5a8fbc599404d7ee0f84dc713bcc7e8c762efb301ced905d0948dd077bab1526605f46d5ac675655e52ad98d
SSDEEP

12288:oeDkUkqDYViCukcCaGMxDVS5VNW59AyuaL6jCWtdP5P4BpOXDIegD:ou3cViCHnM+5aAqydPNQ

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2896	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	28
PID 2832 wrote to memory of 2896	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	28
PID 2832 wrote to memory of 2896	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	28
PID 2832 wrote to memory of 2896	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	28
PID 2832 wrote to memory of 2996	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2996	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2996	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2996	2832	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2996

memory/2832-0-0x000000007EF90000-0x000000007EFAF000-memory.dmp

Filesize
124KB

Download
memory/2832-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2832-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2896-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2896-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2996-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download