603f4fbaad0315e9fd3d2f2ec442cc58913a5c1875a5a3f1f9e981b1f8ecfdf3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 17:08

Target

16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe
Size

212KB
MD5

16ce9cf6ab0f056463105869ccce0b92
SHA1

6fd6f9052f28e7b2c26e5b84a3550ee347c414d0
SHA256

603f4fbaad0315e9fd3d2f2ec442cc58913a5c1875a5a3f1f9e981b1f8ecfdf3
SHA512

0e5db87623c9c442ea575cf0434d4f4ad66584853439f05cf2bb17ef849c88450a10554bad96a6884de815c8270150344a335c9b864728df5ce4279bb6c49cd9
SSDEEP

3072:oSRLHCLsqpQtGxYk5jYUMrGPPMAGw2Xu3utwnKjx17kqrbaUCs3eXL35aF9a9LqH:odLsiYUBMAGw2Xu3mgRLyPFA5qs72Q4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2500	1888	16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe	28
PID 1888 wrote to memory of 2500	1888	16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe	28
PID 1888 wrote to memory of 2500	1888	16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\16ce9cf6ab0f056463105869ccce0b92_JaffaCakes118.exe
  2⤵
  PID:2500

memory/1888-0-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp

Filesize
4KB

Download
memory/1888-1-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/1888-2-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/1888-3-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/1888-4-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download