521985392de473335bede225c730fd0f750e8a5c2efdb193ff8a31d01462e1a1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:52

Target

612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe
Size

687KB
MD5

612bf1bf21a3035516d56bee863bdcd1
SHA1

bb1d1e82fce9292e5a5f390ed27edc001332a51d
SHA256

521985392de473335bede225c730fd0f750e8a5c2efdb193ff8a31d01462e1a1
SHA512

5884cbb415ca5bb9873e30da1b57da4ae4e3c7b787d5eed55068fc1470a54702aa8cb478b8bbb96844f317c9b5369cef890b19a226a01b6a311c49377f1969c5
SSDEEP

12288:rlUsKtNf0yavc7GeVVM4RP36KYOE/8iVYXLAAn3zlB/D7lAj:lyN0TclV9RCKWZuF5dnl4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2744	2092	612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2744	2092	612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2744	2092	612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\612bf1bf21a3035516d56bee863bdcd1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 392
  2⤵
  PID:2744

memory/2092-0-0x000007FEF531E000-0x000007FEF531F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2092-2-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2092-4-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-3-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download