84a5028dc49c892ed843899171264874b7147e985057598e597b3f53432f3373

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 01:02

Target

4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe
Size

162KB
MD5

4c2c2a735889634f46fd21cb99b9da32
SHA1

18b6ce86ffde576af017e4694d4784018871abc7
SHA256

84a5028dc49c892ed843899171264874b7147e985057598e597b3f53432f3373
SHA512

1c567b45ab2b23e21778aa52baa29aec76557ac3d20dac7ec6ff6b075c56cd0825c2197fc31390bf0edbebeb5408abcef26b79c7e6a5834474ffc2fbadfd2db9
SSDEEP

3072:oSRLHCLsqpQtGxYk5jYUMrGPPMAGw2Xu3utwnKjx17c/1F+muFIj7Kxvu50kwMv:odLsiYUBMAGw2Xu3mI/1F+muFIj+xvu/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2788	2016	4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2788	2016	4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2788	2016	4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4c2c2a735889634f46fd21cb99b9da32_JaffaCakes118.exe
  2⤵
  PID:2788

memory/2016-0-0x000007FEF650E000-0x000007FEF650F000-memory.dmp

Filesize
4KB

Download
memory/2016-1-0x000007FEF6250000-0x000007FEF6BED000-memory.dmp

Filesize
9.6MB

Download
memory/2016-2-0x000007FEF6250000-0x000007FEF6BED000-memory.dmp

Filesize
9.6MB

Download
memory/2016-3-0x000007FEF6250000-0x000007FEF6BED000-memory.dmp

Filesize
9.6MB

Download
memory/2016-4-0x000007FEF6250000-0x000007FEF6BED000-memory.dmp

Filesize
9.6MB

Download