3f4569c6831b9bb8453e37dc6dfe0ba219065e135d6a917a744286cac13d6b8d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 08:10

Target

6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe
Size

154KB
MD5

6adeb1a43b493cd250e55d2e0ac97429
SHA1

0e6c5024e7f1bcc413073f703452479187431bb7
SHA256

3f4569c6831b9bb8453e37dc6dfe0ba219065e135d6a917a744286cac13d6b8d
SHA512

9a0bb19decfa7c938700c093dbde587812493324dc25727babd6e9b7f51f9ebc36500da9cde1d0cec2b3e6969a72a49eac8de4e12ff18d60a061578d1707a7da
SSDEEP

3072:4KxqrRiZMALaNiGG/qcT+fpcHjouGQ/JseIbc8AI9TbX:TLvcB4TTiSUuGQ/Jslc8T

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1196	2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe	21
PID 2480 wrote to memory of 1196	2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe	21
PID 2480 wrote to memory of 1196	2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe	21
PID 2480 wrote to memory of 1196	2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe	21
PID 2480 wrote to memory of 1196	2480	6adeb1a43b493cd250e55d2e0ac97429_JaffaCakes118.exe	21

memory/2480-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2480-1-0x00000000003B0000-0x00000000003CD000-memory.dmp

Filesize
116KB

Download
memory/2480-0-0x00000000003A0000-0x00000000003AF000-memory.dmp

Filesize
60KB

Download
memory/2480-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download