bc7613374a7e21343c50d3c69adef38e909484bbe800672866c9b187d761d204

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 03:09

Target

a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe
Size

216KB
MD5

a9593711f9d287cafed0e8319a98c597
SHA1

f1cb647b89166831e56ad46a1ee9bca54edbb253
SHA256

bc7613374a7e21343c50d3c69adef38e909484bbe800672866c9b187d761d204
SHA512

7d4ac7ffe583dce6a7d06edaa582e5c99cec4612e1256bfaf7321cbd7eff38a055ac541bcc1627cf5108a6b287ed5b928402d78d2f6b52ca25bfe0f2629d577a
SSDEEP

3072:x2HDiwUGkqrnrLRrQ3Sz7EJY495GfM9vyPN/d/6D+xI0r:oLxPRrQz5t96d/e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2320	1072	a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe	29
PID 1072 wrote to memory of 2320	1072	a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe	29
PID 1072 wrote to memory of 2320	1072	a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9593711f9d287cafed0e8319a98c597_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:2320

memory/1072-0-0x000007FEF588E000-0x000007FEF588F000-memory.dmp

Filesize
4KB

Download
memory/1072-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1072-2-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download