c545e3d48bfaaccdb5d5c2d41102d18022a67861021b3667a971fff67aec598d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:18

Target

35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe
Size

180KB
MD5

35144d13f40d68eac70021aeaf31965f
SHA1

40b17cd61b704c1adb1c6aaf86d2c5b0d8ea7936
SHA256

c545e3d48bfaaccdb5d5c2d41102d18022a67861021b3667a971fff67aec598d
SHA512

58aa79f697561377b95a7d1b2b0645bfa05e3d3b63ba39ef760ed30c1818b17c5596bb4db1110ffc01c88dab08fd2f9968a39b638e26b67444493593ca895544
SSDEEP

3072:TjYUXT1pmQUuMFuloJZ4j4V5HMZBZTZ5TQKwqQHcCHkQ+3MJ:nYUjMF0qS4MbFZ5TdQHJkQ+3y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2520	2104	35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2520	2104	35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2520	2104	35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  PID:2520

memory/2104-0-0x000007FEF571E000-0x000007FEF571F000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2104-3-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2520-2-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download