369b1f9daff145ea97f76bf9fd217e2387259bea68032834fb189b82ddfef8a8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:40

Target

5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe
Size

28KB
MD5

5adaa8ee603008f6d035e4bd8798bc52
SHA1

36c666ee937dfee8835a36e385b7b23be91ec298
SHA256

369b1f9daff145ea97f76bf9fd217e2387259bea68032834fb189b82ddfef8a8
SHA512

e0e8a5ce5e69d9e9fc527c2cfa1ecfcac9c366caded826927769769bb689d36d969704baf9b249ef9efe18f2d7e7de923935274efc4909dd9cfb2ee24f7a8eea
SSDEEP

384:UmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J1C:hUjKVjl9xw3x6nz7vj1wrc

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe
2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1256	2648	5adaa8ee603008f6d035e4bd8798bc52_JaffaCakes118.exe	21

memory/1256-2-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1256-8-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2648-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2648-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-20-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download