28bdb9537881e0761e00cbf32eb14c78b7c207a2cef7810c8b6eb45688bee93e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 02:01

Target

69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe
Size

428KB
MD5

69d7f3028cae8a4ac8dbd482aba9e49e
SHA1

bb4c853f9f9b6e83b321aae86e846f024e09d6ce
SHA256

28bdb9537881e0761e00cbf32eb14c78b7c207a2cef7810c8b6eb45688bee93e
SHA512

83a914ab7123cbb831ec673580b367d295d55308e3ef9d5a045d65eebaaa83069410e90a9dd119cca9432cff5be6fd9d250bfef95f7472d6b5523949519dac5e
SSDEEP

12288:mRQqQESQ8b0N00jbecj1rtE0ZRwkQl6BB:wQqQESQ8bd0jbdj3Zukg6j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1784	2184	69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe	30
PID 2184 wrote to memory of 1784	2184	69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe	30
PID 2184 wrote to memory of 1784	2184	69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69d7f3028cae8a4ac8dbd482aba9e49e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  PID:1784

memory/1784-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2184-0-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-3-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Filesize
4KB

Download
memory/2184-4-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download