31451108698dce42735375f0df7f5b1ebf5752cb06bc3cc258a3b5f2f6baeb31

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 18:24

Target

a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe
Size

83KB
MD5

a3a2582772bf5a4c177a09f5c5f2ebbf
SHA1

3fdda1ba0c68870647e9c379523c101b029e6238
SHA256

31451108698dce42735375f0df7f5b1ebf5752cb06bc3cc258a3b5f2f6baeb31
SHA512

44064c2a67a1f84c2f82db6f86faef3609d6b938ca1905045452a75b365dd1e5ed68ad3b56de4609a4a887a76604803a7833970b0614ae6b9d59511ff4db31fa
SSDEEP

1536:bek9/BNup1oKst0is5L4nw6uMcZuzseV+m+q1:ak99nsNiw6uMcZuz7+E1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2428	576	a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe	30
PID 576 wrote to memory of 2428	576	a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe	30
PID 576 wrote to memory of 2428	576	a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a3a2582772bf5a4c177a09f5c5f2ebbf_JaffaCakes118.exe
  2⤵
  PID:2428

memory/576-0-0x000007FEF59BE000-0x000007FEF59BF000-memory.dmp

Filesize
4KB

Download
memory/576-1-0x000007FEF5700000-0x000007FEF609D000-memory.dmp

Filesize
9.6MB

Download