1292ba3bc0933fdbc6bc4f30b1b5c31caca50f53bed303e81c99869974f8e5f1

Analysis

max time kernel
20s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 17:01

Target

687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe
Size

39KB
MD5

687064e6f9b35e1a09fabfeb2b03730b
SHA1

98c253985b2c88ce5e835f46a4ddc773029446c4
SHA256

1292ba3bc0933fdbc6bc4f30b1b5c31caca50f53bed303e81c99869974f8e5f1
SHA512

dc64f10226b3b4f6f8ddad472e48752d003abd25edffa8d5a6ab4f0de3c42bf280fa71fdf73223af0b1a806aca1eefb3d528c359243cd95bd342994f7dcb8881
SSDEEP

768:0wzhBgsGvf/y6JlilxFKKP+bTGhag7DSf+6gA6n:0wjcS6riZr+vS7T6X8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2348	3008	687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe	29
PID 3008 wrote to memory of 2348	3008	687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe	29
PID 3008 wrote to memory of 2348	3008	687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\687064e6f9b35e1a09fabfeb2b03730b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 872
  2⤵
  PID:2348

memory/2348-3-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/3008-0-0x000007FEF46DE000-0x000007FEF46DF000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x000007FEF4420000-0x000007FEF4DBD000-memory.dmp

Filesize
9.6MB

Download
memory/3008-2-0x000007FEF4420000-0x000007FEF4DBD000-memory.dmp

Filesize
9.6MB

Download
memory/3008-4-0x000007FEF4420000-0x000007FEF4DBD000-memory.dmp

Filesize
9.6MB

Download
memory/3008-5-0x000007FEF46DE000-0x000007FEF46DF000-memory.dmp

Filesize
4KB

Download