ef9eacb906781043105adbd90d3f790d696d67d6b7dede1f164d517a0276da64

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:07

Target

4953538ea7d90833f849241648d2c251_JaffaCakes118.exe
Size

138KB
MD5

4953538ea7d90833f849241648d2c251
SHA1

5fe268659ec39d7d6eacb7ff0876e95ec44aca5f
SHA256

ef9eacb906781043105adbd90d3f790d696d67d6b7dede1f164d517a0276da64
SHA512

d17159ef8e495cf62a96a1c558ca9c3f1d0086ca8bded5124fb41c6fa1e91085d11233e448c79a6bb150ace2503b5bbdde686282bc8b1f33412465950841dba5
SSDEEP

3072:VN3TLvt6RI19oGr99XoFuNMI8ycbhsQaUB6CES24T3VmSKcwSonIWBJ2rCKAEtj7:VdLvAIoY99XoUNnbcbWQ3BJ5T3svc3XL

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2704	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	29
PID 1360 wrote to memory of 2704	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	29
PID 1360 wrote to memory of 2704	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	29
PID 1360 wrote to memory of 2704	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	29
PID 2704 wrote to memory of 2804	2704	net.exe	31
PID 2704 wrote to memory of 2804	2704	net.exe	31
PID 2704 wrote to memory of 2804	2704	net.exe	31
PID 2704 wrote to memory of 2804	2704	net.exe	31
PID 1360 wrote to memory of 2204	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	32
PID 1360 wrote to memory of 2204	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	32
PID 1360 wrote to memory of 2204	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	32
PID 1360 wrote to memory of 2204	1360	4953538ea7d90833f849241648d2c251_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2868	2204	net.exe	34
PID 2204 wrote to memory of 2868	2204	net.exe	34
PID 2204 wrote to memory of 2868	2204	net.exe	34
PID 2204 wrote to memory of 2868	2204	net.exe	34

C:\Users\Admin\AppData\Local\Temp\4953538ea7d90833f849241648d2c251_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4953538ea7d90833f849241648d2c251_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:2804
- C:\Windows\SysWOW64\net.exe
  net stop SharedAccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SharedAccess
    3⤵
    PID:2868

memory/1360-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1360-1-0x0000000000445000-0x0000000000448000-memory.dmp

Filesize
12KB

Download
memory/1360-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1360-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1360-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1360-6-0x0000000000445000-0x0000000000448000-memory.dmp

Filesize
12KB

Download