ffbb667693545b0fb17e56400be3e5ecb1fe89ede174b002480c706675667ba8

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:59

Target

48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe
Size

54KB
MD5

48843e79a4906b23b20a794536c8d230
SHA1

667589cee853ee0ac447b7934566368fdc85a206
SHA256

ffbb667693545b0fb17e56400be3e5ecb1fe89ede174b002480c706675667ba8
SHA512

805a697be4e7bb77e9da0f8b3546998be9112267d5783b0d4bb9ee8b29f8e7183245f5669a7cb33735115bed7c396d6238095a20270f6fbb93c8934722b1ed50
SSDEEP

1536:rtV6HGavhgapIXp8eqDoLixmYi2Vqdk2IEcn:rtVqnv9IXp8hEixmJGqd7Ihn

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe
1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1208	1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe	21
PID 1604 wrote to memory of 1208	1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe	21
PID 1604 wrote to memory of 1208	1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe	21
PID 1604 wrote to memory of 1208	1604	48843e79a4906b23b20a794536c8d230_JaffaCakes118.exe	21

memory/1208-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1208-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1604-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1604-4-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1604-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download