cf9d0766e7ad9a7f3742344106c9d6560525ff4a48e2f274ff20f50f42e96888

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 06:25

Target

0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe
Size

124KB
MD5

0d04282c77bf09fc97ccf2daa1812283
SHA1

27d26613b53e8ac940a57940aaffe939927ec964
SHA256

cf9d0766e7ad9a7f3742344106c9d6560525ff4a48e2f274ff20f50f42e96888
SHA512

250cad2d7046c4ec86f48d2ce1ca044d1767733bdd6c901cba694907bffca931131b87bbe5ffa741ec68edb914466cd92999691ace38329240d5a8b2e0d3c756
SSDEEP

3072:4/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSXL:ztzsb5Uh28+V1WW69B9VjMdxPedN9ugj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1936	2936	0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe	29
PID 2936 wrote to memory of 1936	2936	0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe	29
PID 2936 wrote to memory of 1936	2936	0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\190C.tmp\190D.tmp\190E.bat C:\Users\Admin\AppData\Local\Temp\0d04282c77bf09fc97ccf2daa1812283_JaffaCakes118.exe"
  2⤵
  PID:1936

C:\Users\Admin\AppData\Local\Temp\190C.tmp\190D.tmp\190E.bat

Filesize
134B

MD5
5b777d29ef9b201a444d778126b092df

SHA1
946db6e3e0b5ceb61f39aaafa83609c1e84bdcf5

SHA256
2573648589e8f4a7feb84007817575494b534c5f8762335fed8d48aea55ddef9

SHA512
c8dafb7c412b3d67e51c0a8f5540b0cabc28a63062c2aa9c0bb2c963a57b8e4a77539d958b2a9497078d1cee3b7c574cf0dd31390e9a0cc00b96c49dad0f3fd3

Download Submit