f524b6e667e928bb4e84074d525eba8449aad4e296d352b5fc2b9c91ba978155

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 16:31

Target

312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe
Size

20KB
MD5

312209ab1342e7dd35be136f6583cda3
SHA1

0e2a909ba008adc9871acd8752c48e702f495554
SHA256

f524b6e667e928bb4e84074d525eba8449aad4e296d352b5fc2b9c91ba978155
SHA512

0a05ff8e1f2ff1ab96623f205ab020744226e8e28b914c19c64cf5215857fc617d8e1e69906ab92ce56e18e367748ade2499987c2d365f67cb82f74c09ac804e
SSDEEP

192:I/OPTfNTyynXQfOntugSeiJxtPWfe5sRhgEgSi8fP1oynM1Cz:GOL/nHyxB5sRCEnn1K1Cz

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2676	2072	312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2676	2072	312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2676	2072	312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2676	2072	312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe	30
PID 2676 wrote to memory of 2744	2676	net.exe	32
PID 2676 wrote to memory of 2744	2676	net.exe	32
PID 2676 wrote to memory of 2744	2676	net.exe	32
PID 2676 wrote to memory of 2744	2676	net.exe	32

C:\Users\Admin\AppData\Local\Temp\312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\312209ab1342e7dd35be136f6583cda3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\net.exe
  net start MONITORWMIDE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start MONITORWMIDE
    3⤵
    PID:2744