306ad78627b4855709bcfe4182b7260ea4daf4771f7a08ec5727cc3b9be5cca8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:07

Target

5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe
Size

1.2MB
MD5

5ac01141edfdd7ef3f61ade05a7e3f0c
SHA1

125fe7d568323bb149d434b8e7f152147e1f13ef
SHA256

306ad78627b4855709bcfe4182b7260ea4daf4771f7a08ec5727cc3b9be5cca8
SHA512

bab22d50b31b6da7775e32c9e9b5a40bf8db73c7acd01aa32638a70152b01bf0a9e73b879d0aaec781a026baf6a4e3c5f2835a25aeefd8e5c031806cfe7e9413
SSDEEP

12288:xfydLVaIXozN+blNjvIaanuWikU+HBwKKUzSBEcwnYUx5jST9sKvvw86Gg3Ei9zX:xMLVae3oTrLPIFdB/1XEhgC

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2680	2252	5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2680	2252	5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2680	2252	5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2680	2252	5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ac01141edfdd7ef3f61ade05a7e3f0c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  PID:2680

memory/2252-0-0x0000000074301000-0x0000000074302000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2252-2-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2252-4-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2680-3-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download