21e92c5b322079edc40dac0fc4c19078ee06622c863fd559faae1fdbf3700a0b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 06:07

Target

093366b6536286beab1d3968c69948e7_JaffaCakes118.exe
Size

553KB
MD5

093366b6536286beab1d3968c69948e7
SHA1

f20c57681de1ba54311f57fe3c283dad7a110e8f
SHA256

21e92c5b322079edc40dac0fc4c19078ee06622c863fd559faae1fdbf3700a0b
SHA512

7c4e01df9e6eb57978153b7f789745b3ae6fb221ccd5473838401813373b9fd96bdc20bc36b8ef905583ba4c4ff570fb4d0be9da2f7fad06af3be020393e8893
SSDEEP

6144:JrPe87we8zvtqgIl1Mltu7KgxHCttAL927uuIPsMopd2KVYkRBpwBn678YYWeEx:JrP5z8rtdIlWt0K0mtAR27NIJofvUy

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2000	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2000	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2000	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2000	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	28
PID 2972 wrote to memory of 1280	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1280	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1280	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1280	2972	093366b6536286beab1d3968c69948e7_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\093366b6536286beab1d3968c69948e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\093366b6536286beab1d3968c69948e7_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\093366b6536286beab1d3968c69948e7_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\093366b6536286beab1d3968c69948e7_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1280

memory/1280-3-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1280-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2000-4-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2000-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2972-0-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/2972-2-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download