152f833e10ac57e59b01b032481545819cb4ad377e7a7ce84683f9f605dd1475

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 12:48

Target

94e55e6a3025550c6df161181484887f_JaffaCakes118.exe
Size

573KB
MD5

94e55e6a3025550c6df161181484887f
SHA1

131201c4961c5a7be6d9cf448181208a6dfe64f1
SHA256

152f833e10ac57e59b01b032481545819cb4ad377e7a7ce84683f9f605dd1475
SHA512

24ed6f98a68046ad9a7358ac44e1d6ec966d322877dfccfd8352afde2366cdc6a55679a89bbf88d79d7984c28efaa0ee2af15f43f0752bfedf445994f6998a28
SSDEEP

12288:a1LPWCks1LITPmRvszmPbVaVMHGYqQ4yB2E8dkEC:r5s10TPmRvjbVaCGY5IkEC

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2476	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2476	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2476	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2476	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	28
PID 1500 wrote to memory of 3004	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	29
PID 1500 wrote to memory of 3004	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	29
PID 1500 wrote to memory of 3004	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	29
PID 1500 wrote to memory of 3004	1500	94e55e6a3025550c6df161181484887f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\94e55e6a3025550c6df161181484887f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94e55e6a3025550c6df161181484887f_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\94e55e6a3025550c6df161181484887f_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\94e55e6a3025550c6df161181484887f_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3004

memory/1500-0-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/1500-1-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1500-3-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2476-4-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2476-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2476-8-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3004-5-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3004-6-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3004-10-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download