2503e00d357d0f1b5ff96ebb9735b5a30a4fe59d42fa697ac73dbd7d45128944

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 23:32

Target

371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
Size

585KB
MD5

371e42292e4ca4db5a2b589ccb3b420e
SHA1

7ea109483f548444019d6e00440078a52e647bc6
SHA256

2503e00d357d0f1b5ff96ebb9735b5a30a4fe59d42fa697ac73dbd7d45128944
SHA512

f31ea206c9c78e0a62b06bb9f0b52cc340bb83e2c471feb66672ef8aae60b089f91837aaebdae76d691182c0694df6a84e44fb6ad2bd1ffa63f5fc8b1960c2bb
SSDEEP

12288:6c+PAHuxUR07VutDI2bs23+Z85qc9hr4eRgw:6/PAOxFJIDIesVTGse9

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
2964	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
1244	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2964	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	28
PID 860 wrote to memory of 2964	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	28
PID 860 wrote to memory of 2964	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	28
PID 860 wrote to memory of 2964	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	28
PID 860 wrote to memory of 1244	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	29
PID 860 wrote to memory of 1244	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	29
PID 860 wrote to memory of 1244	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	29
PID 860 wrote to memory of 1244	860	371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\371e42292e4ca4db5a2b589ccb3b420e_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1244

memory/860-0-0x00000000002C0000-0x00000000002DF000-memory.dmp

Filesize
124KB

Download
memory/860-2-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1244-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1244-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2964-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2964-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download