223050e18bf7faeb473e44b1deeeb0700356c28b94608cc4d2392c6d1fda7fe9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 08:25

Target

40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
Size

532KB
MD5

40d799b5e2be2e4da2ac46f59120ae42
SHA1

3ce63ffec3caa1031e63b3aeeeb05262e0a110c6
SHA256

223050e18bf7faeb473e44b1deeeb0700356c28b94608cc4d2392c6d1fda7fe9
SHA512

d360b5fa092da877b6387af3144fa79406cc9081f2d86d38e0617144785faafd2f7a378e3901b821068eb77d9e19fff4f64a43ea4853963665556ed87f1f0b9c
SSDEEP

6144:v1wWhTirydGp5m+DGxyaRNZy/3yRy5CKK4+/JR1eQ3x2CJIIuThsz8fyaM/uYM6X:v1n/Epdw0fyRy0BxbB2YIIuThsoaZX

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
288	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
2304	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 288	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	28
PID 2452 wrote to memory of 288	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	28
PID 2452 wrote to memory of 288	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	28
PID 2452 wrote to memory of 288	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2304	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2304	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2304	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2304	2452	40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:288
- C:\Users\Admin\AppData\Local\Temp\40d799b5e2be2e4da2ac46f59120ae42_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2304

memory/288-4-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/288-6-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/288-8-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2304-5-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2304-7-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2304-9-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2452-0-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2452-1-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2452-3-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download