82bfad83ba9b1fe690e24e1a1b870dc6d3be3df5248e0a9fa8c149efad0caa21

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 23:10

Target

61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe
Size

4KB
MD5

61cb2f6d502a091e4d306c82931aed5f
SHA1

716834e7ad09ef650a07aacd0cbd71b795e7f0cd
SHA256

82bfad83ba9b1fe690e24e1a1b870dc6d3be3df5248e0a9fa8c149efad0caa21
SHA512

78aa38334d347cd6f1ebc6f8dd12d98f7c5b4d1fd5b558ece8db0bbd3aecaf46a2e5d5bef9ad2a5f648695c29f40e3c89f8b9c0fccb5ed3aa977c0cb3310f25c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2432	2168	61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2432	2168	61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2432	2168	61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61cb2f6d502a091e4d306c82931aed5f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 620
  2⤵
  PID:2432

memory/2168-0-0x000007FEF575E000-0x000007FEF575F000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-2-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-4-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2432-3-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download