e8c37775148975cfeaabf41d3806b7be1bb66286ec4f5a5861469df37ea09404

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 17:21

Target

09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe
Size

1.6MB
MD5

09d368aef2e73573a342522d02a6b69d
SHA1

a0f79ed0759b97c47028e28a08b1d0205bd6a018
SHA256

e8c37775148975cfeaabf41d3806b7be1bb66286ec4f5a5861469df37ea09404
SHA512

e7babe7509d50b04f013598c95aacab70bfd9c4afa9e74fbadeac0336a1f4729e0b359b61c124c7728b628780f1740ec428ac5dc627df8246b2688439a09a15a
SSDEEP

24576:TlwHpsVXpruoJdXN0BN2qnw4a+edxoBrLdggNxzfadB3Ic:SH2VZruoJdXN0BMOwLloBrugnydB3Ic

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2248	2180	09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2248	2180	09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2248	2180	09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09d368aef2e73573a342522d02a6b69d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2248

memory/2180-1-0x000007FEF5F4E000-0x000007FEF5F4F000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x0000000000430000-0x0000000000446000-memory.dmp

Filesize
88KB

Download
memory/2180-2-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2180-4-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-3-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download