3a7b90f7de47bae69498008ea4abd33029263972dd7cfc7c8bb83d871034be23

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 04:51

Target

adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe
Size

7KB
MD5

adeb9a5f04ac56fda8bd868100562453
SHA1

e1e423e7b0537859aeb1d74bc5dba7ef96456274
SHA256

3a7b90f7de47bae69498008ea4abd33029263972dd7cfc7c8bb83d871034be23
SHA512

b1e5909b29a1ed19508d3a2cd2062c1a1d7fcaf91b8e42e40277e052e88cad8df89e1d23dfd4a15923799e5c3715f5a4e1f867be7ed61fd934763605b9210af3
SSDEEP

96:5SmG6kHWjs8FAWJ2sSorvF5cE2TYlnlYJnLeL0Kff345C5v1VRXmm6CBajF:5Fjs85SuwV2nlYJLeLTg4/6CS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2388	900	adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe	31
PID 900 wrote to memory of 2388	900	adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe	31
PID 900 wrote to memory of 2388	900	adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\adeb9a5f04ac56fda8bd868100562453_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2388

memory/900-0-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmp

Filesize
4KB

Download
memory/900-1-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/900-2-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/900-4-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/900-5-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmp

Filesize
4KB

Download
memory/2388-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2388-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download