35e890db7e93cabe8e209977aa82f40753639355ebeeb7bf82c284830b475c17

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 11:31

Target

1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe
Size

1010KB
MD5

1b20fe45fce4af68611e28701aee46c3
SHA1

abd3eb3410e099307fa8919a8b8683dfd349a2a3
SHA256

35e890db7e93cabe8e209977aa82f40753639355ebeeb7bf82c284830b475c17
SHA512

329f93227dd5083c89ca6763a6ece00e4bb71039d2059dd9df2e7cc52ce6ac9ce61e045ba54fa2e71c1094dde703a5698621a693b14d01e412867d0f5eadfdc1
SSDEEP

12288:gcY+4aiKq7mtZ4ZaKOunZaKOueZaKOuRUivGYXJqmSHEHKgdpdD3B6ViIADs0:3Y3KqS/4ZPnZPeZPRnvGySHODakDx

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2192	3060	1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2192	3060	1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2192	3060	1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe	28
PID 3060 wrote to memory of 2192	3060	1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b20fe45fce4af68611e28701aee46c3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:2192

memory/2192-3-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/3060-0-0x0000000074AC1000-0x0000000074AC2000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-2-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-4-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download