6255445d56b8372ff913426736b950814987686116b27afc927f0fbdb05d6373

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:09

Target

15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe
Size

268KB
MD5

15453e96d559f2ced4365d84219d0548
SHA1

65aee8c126890f7476870974a521895e6e7e436f
SHA256

6255445d56b8372ff913426736b950814987686116b27afc927f0fbdb05d6373
SHA512

32371f12cae8e44aa611b932ef830333c992e4213166d99a5190325492524c218daf3460753a3ffe9a8cf77d60d064970c27a1b8c74d61052fd0bf9ab52cd5f8
SSDEEP

3072:ZvWVRWSq4m1eKcdOjO5OKUw7V89wmnfLSUkYhk9s42TqbVKuh+DEOXpq0q3/5ZV:sRWSqVEUzRnfLSokPvVADEO8TB

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2396	2044	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2396	2044	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2396	2044	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2396	2044	15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15453e96d559f2ced4365d84219d0548_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- \??\c:\users\admin\appdata\local\temp\15453e96d559f2ced4365d84219d0548_jaffacakes118.exe
  "c:\users\admin\appdata\local\temp\15453e96d559f2ced4365d84219d0548_jaffacakes118.exe"war3.exe"
  2⤵
  PID:2396

memory/2044-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2044-1-0x0000000001CC0000-0x0000000001D0B000-memory.dmp

Filesize
300KB

Download
memory/2396-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download