3308fe8ed81241b843ee2b0ca9608280c070d69b3380ff945b5e369aafb0d028

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 19:01

Target

361381afe79d3952809da87195e2506f_JaffaCakes118.exe
Size

86KB
MD5

361381afe79d3952809da87195e2506f
SHA1

34b6ea9720a1129c9c137142c1eb6fe26d17ab81
SHA256

3308fe8ed81241b843ee2b0ca9608280c070d69b3380ff945b5e369aafb0d028
SHA512

deba4e200cf5c52529809bb4ecec2b187e4bd429ea2d449ea4ae072389bc84f10df9ca799ad4512efbbcda88a540bf27f29c04d1ce5ac14a8c483a318e5485e5
SSDEEP

1536:oMxmj8aHdjWGR/+yLFomQY1gm8W/Tj50pfBt596y8FMF6cst:oMxmj8aHdjWGwyRbvmpnp8Q6L

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2028	2040	361381afe79d3952809da87195e2506f_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2028	2040	361381afe79d3952809da87195e2506f_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2028	2040	361381afe79d3952809da87195e2506f_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2028	2040	361381afe79d3952809da87195e2506f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\361381afe79d3952809da87195e2506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\361381afe79d3952809da87195e2506f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:2028

memory/2028-3-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/2040-0-0x0000000074221000-0x0000000074222000-memory.dmp

Filesize
4KB

Download
memory/2040-1-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-2-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-4-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download