5c3b2fe5873a54967b60abe38b7667f061e96ca69e494a3ee785e3ccf90b6f44

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:53

Target

3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe
Size

1.9MB
MD5

3f04c30b7cc8af8b444f8a9d600508fc
SHA1

6fd4bd6586385a6ccf73726c440a7641eb2f333f
SHA256

5c3b2fe5873a54967b60abe38b7667f061e96ca69e494a3ee785e3ccf90b6f44
SHA512

3d5caebfd38a067aa703db655410cc2c0eb3cc3d371053276f39d3e536f75687183ba83177039b7a68b2a67f25687db03279a0fe4fa700cb30d1ad0e4525a313
SSDEEP

24576:Kh5tIWRAMj8LWSm7J6/gvq3lIH1PyXSmFwOpzhl5IBKAl0Ndrpwy1j5cIdYAMn1r:Katm9S3qP3mF/p/Cxw8vR0

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2216	824	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	31
PID 824 wrote to memory of 2216	824	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	31
PID 824 wrote to memory of 2216	824	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	31
PID 824 wrote to memory of 2216	824	3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f04c30b7cc8af8b444f8a9d600508fc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2216

memory/824-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/824-1-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download