51ab3edd7006be89892ad851fa4471a071a0b28de8fea85904ccb83e3cce964a

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:36

Target

4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe
Size

116KB
MD5

4ca7bfed7aa4114656cbbf2ee80684f8
SHA1

8fe148a4acf83eb1c01fbf2ca8dc61c3d43ae6b3
SHA256

51ab3edd7006be89892ad851fa4471a071a0b28de8fea85904ccb83e3cce964a
SHA512

432fd226b75a074b5e63bfd14cc2948853d779c775745db1f213b070e1946fb0d2ab50e83f389f35ca661d756acc185aaac52ab59e08289ee3190d245a154daa
SSDEEP

3072:QUvu1ilO3RbXjB9p9K/SkMgtIyBzJJqJLEH0Ws:FvICO3RbTG/SPqIW0Ws

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2240	2212	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2240	2212	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2240	2212	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2240	2212	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2240	2212	4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ca7bfed7aa4114656cbbf2ee80684f8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2240

memory/2240-1-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download