59eb8841609684c26be763ba2267802b949904e297ed0577e022f5a608712a24

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 16:13

Target

0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe
Size

323KB
MD5

0eb6b32110a98efc6ee9c20aed11bd07
SHA1

3c4b621ba3099e1241347c33aaad842320aff974
SHA256

59eb8841609684c26be763ba2267802b949904e297ed0577e022f5a608712a24
SHA512

38012e29f93faeca2d659757c3f3ddf1063b2f6457bfd44e670762f1a62b24a78fb4b68fa93bab55c271a45f7d8923c2b1bde3d4090fe0d7b0755a06c617c9f8
SSDEEP

6144:TmtD92zZPhbN9XU/gDEvTzRUmOqkpgO1B+qc13Xh4+NhVRowl:Tmtx2zZZbUjm5qk2OGpfRoe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2188	3060	0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2188	3060	0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2188	3060	0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eb6b32110a98efc6ee9c20aed11bd07_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 452
  2⤵
  PID:2188

memory/2188-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/3060-0-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/3060-2-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/3060-4-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download