129cf2d96d6a9e6265f9f236b8df4ef4ecd919aac2dbbc15f94abb716a034c95

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:27

Target

9320718aae4589f44e5fd97787683526_JaffaCakes118.exe
Size

531KB
MD5

9320718aae4589f44e5fd97787683526
SHA1

a8d876b0464a36581b127a670d394d3450d13fdd
SHA256

129cf2d96d6a9e6265f9f236b8df4ef4ecd919aac2dbbc15f94abb716a034c95
SHA512

159e21afb163790dd44ca2f2d6c4c110eec0cdeefcef8b403f30e50b412c82ab86034491b9233168d200f0a5a8886a88ed82358fa1a282319bbdc3708487b8e3
SSDEEP

6144:vtS2++TzIWiZREzTnOtkY9sErdh7CEEFYy8h5myUsJj8p0gLLzh7+CKKRA:v82HzIWKREzbikY9jrHP4aGLzZK

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2392	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2184	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	29
PID 1792 wrote to memory of 2184	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	29
PID 1792 wrote to memory of 2184	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	29
PID 1792 wrote to memory of 2184	1792	9320718aae4589f44e5fd97787683526_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\9320718aae4589f44e5fd97787683526_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9320718aae4589f44e5fd97787683526_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\9320718aae4589f44e5fd97787683526_JaffaCakes118.exe
  start
  2⤵
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\9320718aae4589f44e5fd97787683526_JaffaCakes118.exe
  watch
  2⤵
  PID:2184

memory/1792-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1792-1-0x0000000005000000-0x0000000005069000-memory.dmp

Filesize
420KB

Download
memory/1792-3-0x0000000000540000-0x00000000005C7000-memory.dmp

Filesize
540KB

Download
memory/1792-2-0x0000000000500000-0x0000000000540000-memory.dmp

Filesize
256KB

Download
memory/2184-4-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2184-6-0x0000000000830000-0x0000000000870000-memory.dmp

Filesize
256KB

Download
memory/2184-5-0x0000000005000000-0x0000000005069000-memory.dmp

Filesize
420KB

Download
memory/2184-10-0x0000000005000000-0x0000000005069000-memory.dmp

Filesize
420KB

Download
memory/2392-8-0x0000000005000000-0x0000000005069000-memory.dmp

Filesize
420KB

Download
memory/2392-7-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2392-9-0x0000000005000000-0x0000000005069000-memory.dmp

Filesize
420KB

Download