0ee2d0a37d899b0993b0d5841e94b06dbc41c6a58182cf63d54f49964dff166b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 06:41

Target

192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe
Size

7KB
MD5

192743556baa9697e8a6d35774f2cf2e
SHA1

29890d8e184b4635959ae312a5c1e18f48c61ad4
SHA256

0ee2d0a37d899b0993b0d5841e94b06dbc41c6a58182cf63d54f49964dff166b
SHA512

05b2bac31d8c9290eab625d484297de06dca7e9aa15cf2abeb9d3de5f573bcaebc7803d5a830f6c699b2696fb6f43f7bd9282e76aa99183aa8228fb55efc4a7c
SSDEEP

96:mzSmG6kHWjs891wQ2sSorvF5cE2TYlnlYJnLeL0Kff345CLv1r5RXmm6CBajF:mzFjs8PweSuwV2nlYJLeLTg4ln6CS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1944	1700	192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe	29
PID 1700 wrote to memory of 1944	1700	192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe	29
PID 1700 wrote to memory of 1944	1700	192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\192743556baa9697e8a6d35774f2cf2e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1944

memory/1700-0-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1700-2-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1700-4-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download
memory/1700-5-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1944-6-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download