04d47a20560e32d12659dd0cdbb8aead4e6ad1c1701307d8aefb218ef604d325

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 14:43

Target

0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe
Size

1.3MB
MD5

0ec8a1a99ce3085d13be2d881fda4938
SHA1

f341e96a338d8d81967b029076b39929d6a77e48
SHA256

04d47a20560e32d12659dd0cdbb8aead4e6ad1c1701307d8aefb218ef604d325
SHA512

1f64d11deacabfd0588d3788402302a672d7e2ca85c7c8d1d4a5b16fb0e1222919b40819d32d6c1495318fc5a57b363a8b35e6f5f226d95436fbcf9785625d90
SSDEEP

12288:6VvcihmP7HLrBfH++yQD/mm5inh9u+cscawLkBZ/nfcnrEvKd+TyzOal2B7Qefvf:i2BWYu1Dcrnn0h2RlQ/6k27W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2936	2868	0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec8a1a99ce3085d13be2d881fda4938_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 372
  2⤵
  PID:2936

memory/2868-0-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2868-3-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Filesize
9.6MB

Download
memory/2868-4-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp

Filesize
4KB

Download
memory/2936-2-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download