e2ec52bd75f8b78c7d316a590a74b6a81fc457dcd545fa801846d0abe2dc5854

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:24

Target

3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe
Size

2.2MB
MD5

3eefbc967d934f387e8e806b622de160
SHA1

66b44107ae8804e35779f8622818be2c4b3eb0cd
SHA256

e2ec52bd75f8b78c7d316a590a74b6a81fc457dcd545fa801846d0abe2dc5854
SHA512

f9f11d7b6c6b8f37ef4b1945d53aee58a88c54005fffc5eba1c3329353caa7b7d32adb598b2da15e3f6a276c6cb43751ff91b83e414f27aba7b1d4e1bd1c7f1e
SSDEEP

768:H/FGgxBk06FDMbB9oAgtIPqA/4XhhZFfGA7y8D6cXLhsM:HUUB36+foAgaV4X3rtD6c7hD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2396	2524	3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2396	2524	3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2396	2524	3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3eefbc967d934f387e8e806b622de160_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:2396

memory/2396-3-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2524-0-0x000007FEF63EE000-0x000007FEF63EF000-memory.dmp

Filesize
4KB

Download
memory/2524-1-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2524-2-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2524-4-0x000007FEF63EE000-0x000007FEF63EF000-memory.dmp

Filesize
4KB

Download
memory/2524-5-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download