e6e1dfcc3b870ac4c1704726230dc77b8f6749b24f2833cc50cfa85a7b9ce284

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:09

Target

22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe
Size

56KB
MD5

22779a8fb35c6232d8fde948ec4a86c3
SHA1

e85b5f146842bce2ab14a42a712b24a8eafe3100
SHA256

e6e1dfcc3b870ac4c1704726230dc77b8f6749b24f2833cc50cfa85a7b9ce284
SHA512

fe2e1b61475608193706d2482c63bb48a8c2236e3a44bf3959e50e262e90685de521b13c059ec6cf97528216091963051d3d8d3f76a785e73e9f9c7d3c8c9989
SSDEEP

768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQff/y/vtAAYBDDqBwWpNbe5mf2zfG:kZ/nEkh8OTKNDuA3Q5m+DUp

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe
3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1152	3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe	20
PID 3020 wrote to memory of 1152	3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe	20
PID 3020 wrote to memory of 1152	3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe	20
PID 3020 wrote to memory of 1152	3020	22779a8fb35c6232d8fde948ec4a86c3_JaffaCakes118.exe	20

memory/1152-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1152-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3020-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download