ffa23b824b0181b34a51ab311130a4f7b9aec2ff20f9bf6509ad89b367889f87

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:35

Target

24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe
Size

31KB
MD5

24f64d2376ed592788a62ee67c0094ea
SHA1

1abf2ddadab66ba4551c5ae68df2a85fb432b8c9
SHA256

ffa23b824b0181b34a51ab311130a4f7b9aec2ff20f9bf6509ad89b367889f87
SHA512

eb9fea398390f985f71464287a5a11691b876d526881491b51e32239d83b2ec6e4b251db4be527eedda18b25c0586ad188c07362d943fad2a367412e827b7032
SSDEEP

768:ZYh7TzTBziCfTeiZjVWihwE0nh0L7uTYe9PQWtD:GZfIE0h8uTD9lD

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe
1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1192	1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe	21
PID 1916 wrote to memory of 1192	1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe	21
PID 1916 wrote to memory of 1192	1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe	21
PID 1916 wrote to memory of 1192	1916	24f64d2376ed592788a62ee67c0094ea_JaffaCakes118.exe	21

memory/1192-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1192-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1916-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1916-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1916-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download