13d97e5d022eb5a054a066403d56e6600f48e4971a9564a3487a360761af1c00

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 15:35

Target

4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
Size

577KB
MD5

4202035ca4a4d3641b609e8ecac1115b
SHA1

ac22a582a136441a79985db2a9f8d3abe410e098
SHA256

13d97e5d022eb5a054a066403d56e6600f48e4971a9564a3487a360761af1c00
SHA512

ef1d15651a16be58f9abf043336acd61c4bb6b24aa8834edeb25d7693e2764cb2cd59b08b0c9318b56d8fea9cd8aaaa5f68dc8466906b4a59f36242b85a79288
SSDEEP

12288:Y01wk7W9EA5ISGjMgWSUro3tOQ9gFoh3vc:j1l7W9EA5IlYgzzdV9gB

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 2240	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	29
PID 492 wrote to memory of 2240	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	29
PID 492 wrote to memory of 2240	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	29
PID 492 wrote to memory of 2240	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	29
PID 492 wrote to memory of 1532	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	30
PID 492 wrote to memory of 1532	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	30
PID 492 wrote to memory of 1532	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	30
PID 492 wrote to memory of 1532	492	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1532

memory/492-0-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/492-2-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1532-4-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1532-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2240-3-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2240-6-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download