cfee5c29dfe0788bedbdefe1fab055667531f29800ccd706096c042506af87d4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:27

Target

3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
Size

81KB
MD5

3a13c5141c3f9d4a021c65074afc945d
SHA1

c15f0476e52bafdd7438c7a278f70f20656c83d0
SHA256

cfee5c29dfe0788bedbdefe1fab055667531f29800ccd706096c042506af87d4
SHA512

e1f15ad8db6cf436291249d0517e1866e8c70c928fe54f27853561cfa6926d2a4c8b6ca5cbdf8de6b086ec7f68c5d856aa104ba1b6c3f338468ea5fb63f9ca75
SSDEEP

768:cjnF0Gpb5rkHF19erftpI9PNupCSqFcMwsYWL0is5Cr1aj4BNw67SMlSni4ZTJ2T:ceX97BNup1oKst0is5L4nw6uMGV14T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2692	2652	3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2692	2652	3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2692	2652	3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3a13c5141c3f9d4a021c65074afc945d_JaffaCakes118.exe
  2⤵
  PID:2692

memory/2652-0-0x000007FEF55EE000-0x000007FEF55EF000-memory.dmp

Filesize
4KB

Download
memory/2652-1-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download