21ed5218d9bac37ebb8babbad609af06d9fd309b76ebf898a4a1e5657e83ed12

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:43

Target

1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
Size

589KB
MD5

1fec80b2ddcb2414f8b33d684b594d18
SHA1

57c64af5d590d13ebe3a6434723819e1bc171a24
SHA256

21ed5218d9bac37ebb8babbad609af06d9fd309b76ebf898a4a1e5657e83ed12
SHA512

28a91556f1e31966bd574d1c12d42caf83013d05958ab6fd2b3fa8c36599bc6f04c11fe5f914505c1f41edeeb70c08029b1ec23f080966af21d3075a478da941
SSDEEP

6144:cfcs4dTM9veh+aqrlGkH/u/c8iPOL1Md7NZQKtswxHCuwNfjGEFlj:cfqMve4D8kH/uziGRMdjQKt2NNfLD

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
1900	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
2920	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1900	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1900	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1900	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1900	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	28
PID 1724 wrote to memory of 2920	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	29
PID 1724 wrote to memory of 2920	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	29
PID 1724 wrote to memory of 2920	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	29
PID 1724 wrote to memory of 2920	1724	1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2920

memory/1724-0-0x00000000002C0000-0x00000000002DF000-memory.dmp

Filesize
124KB

Download
memory/1724-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1724-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1900-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1900-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1900-8-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2920-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2920-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2920-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download