2c1f316937e74b79edcd250fb0c7d88e3960c3e61e228af095bf5d1b78465251

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 06:42

Target

44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe
Size

10.7MB
MD5

44f10189f86f683ac194586f9ea65e6c
SHA1

0af2c8022cb08df17c436546f79382e271dea8bf
SHA256

2c1f316937e74b79edcd250fb0c7d88e3960c3e61e228af095bf5d1b78465251
SHA512

e065dfc58f91dd6bbe6ef039472447cc365abc3b7b42f49f2f061a55c8d86bd99ea541e271c9448a2c1bbcf917f1f546c1c6773a5f9ef799423409d011118e66
SSDEEP

98304:v0cWyXspuwk4ad0dUa7vmNRMROCWQKCET3wXEiFR+0dLzhuNS3F:8cWy2bk4k0+AIRMROCW3cFR+qLdEwF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2552	2860	44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2552	2860	44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2552	2860	44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44f10189f86f683ac194586f9ea65e6c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2552

memory/2860-1-0x0000000000400000-0x0000000000EED000-memory.dmp

Filesize
10.9MB

Download
memory/2860-2-0x0000000000400000-0x0000000000EED000-memory.dmp

Filesize
10.9MB

Download
memory/2860-9-0x0000000000400000-0x0000000000EED000-memory.dmp

Filesize
10.9MB

Download