58db6f3d156cf6596245814fd2d16410495fe064b6edf0e44967454073ed3a1d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:43

Target

82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe
Size

244KB
MD5

82bf72ae279772ce52ec0a3f26364540
SHA1

e05701d117689d0db46e31e01f96d87496af87b6
SHA256

58db6f3d156cf6596245814fd2d16410495fe064b6edf0e44967454073ed3a1d
SHA512

b7c629ac78c4bf676e7fae14728e6b6d8cb5e41c65953a6f0d3f785c33f3af5e14b4b897428be9a49f4a84df639b21bf98ca2f5e5195357b3ca2caab0190c58c
SSDEEP

6144:rQIx8Z3LSV7VHH+EGCqmP/x4mp5GYtpuRw6XM3:rQ+8JWV7xHN/xVTL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1688	1080	82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe	30
PID 1080 wrote to memory of 1688	1080	82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe	30
PID 1080 wrote to memory of 1688	1080	82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82bf72ae279772ce52ec0a3f26364540_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 380
  2⤵
  PID:1688

memory/1080-0-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

Filesize
4KB

Download
memory/1080-1-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/1080-2-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/1080-4-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/1080-5-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

Filesize
4KB

Download
memory/1688-3-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1688-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download