6cd957f773fcc713edd29485152b372ed57d0de495be3c9c4cf527217c8df77b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:42

Target

4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe
Size

19KB
MD5

4aec92332581b70199ce012ad6f5be3d
SHA1

0babd4c4cce2cfd66703a23ab7a1aa31b8fb421e
SHA256

6cd957f773fcc713edd29485152b372ed57d0de495be3c9c4cf527217c8df77b
SHA512

ae7591b4a8f240119ed1aa8f6c05d5f5d2d645db1daa8eeb219567cf38e1ce1a90ae3b543bc7570772c30a9550db6a14109e8d059a789290f3589df6f7149dc4
SSDEEP

192:BMoPVsMIGZovsBqX7bk0bym1xabM2mZmjL7nnloYU4jcy8cIo+dNX7v1gWYa5y:iMIG+EMWPuGL724jcyJ1+dNXD11YE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1988	2352	4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe	30
PID 2352 wrote to memory of 1988	2352	4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe	30
PID 2352 wrote to memory of 1988	2352	4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4aec92332581b70199ce012ad6f5be3d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 392
  2⤵
  PID:1988

memory/1988-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2352-0-0x000007FEF574E000-0x000007FEF574F000-memory.dmp

Filesize
4KB

Download
memory/2352-1-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-2-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-4-0x000007FEF5490000-0x000007FEF5E2D000-memory.dmp

Filesize
9.6MB

Download