530461af0bbe905d2f67fe690369063733dc6641e7468ba2aaf33248627c9cbe

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:34

Target

63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe
Size

2.9MB
MD5

63f0c916dce5ab5a6f958578882638a8
SHA1

41a7b599d92a63cae457252b8c44e53d2bea85c6
SHA256

530461af0bbe905d2f67fe690369063733dc6641e7468ba2aaf33248627c9cbe
SHA512

c1379cb53e4bb2b0e27158aa8ab9be8727cca262aa1ac38b22bc3af683863e1daa04f2f9430900608d375355079ebef116bd76617ef637b9dcae4faea83c79e4
SSDEEP

49152:WWsDODrOO53RTqtighKPgssSt2g6c9IW1dXgfC/MHmgJ0g7mM+M6RkMkIM7I067W:3sDODrOO53Ahv7Stgc9IW1dXgfC/MHmq

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3000	1336	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	32
PID 1336 wrote to memory of 3000	1336	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	32
PID 1336 wrote to memory of 3000	1336	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	32
PID 1336 wrote to memory of 3000	1336	63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63f0c916dce5ab5a6f958578882638a8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\hh.exe
  hh secedit.chm
  2⤵
  PID:3000