64c3c43696186860483639762254459d8d88d21a9f64b742c885159db00b4024

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 03:23

Target

b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe
Size

7KB
MD5

b629a12466d33d0924caee4b7cf5e24b
SHA1

4514e2e786e9815fb3b0f705836c87cb3077c7da
SHA256

64c3c43696186860483639762254459d8d88d21a9f64b742c885159db00b4024
SHA512

9120689b1e3e9c99525b6a194256fbd61a0871bc3898e999dda310ff4733d73de05bc9bbe3a130c23ecf0c63f499ea009efba7f4efc1b3191c30f8f8a271c00b
SSDEEP

96:PkoG6kHWjs8pAyIa2sS6Ke5cE2TYlnlYJnLeL0Kff345CZv1VRXmm68ajF:Pljs8lFS6+V2nlYJLeLTg4v6T

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2348	904	b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe	31
PID 904 wrote to memory of 2348	904	b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe	31
PID 904 wrote to memory of 2348	904	b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b629a12466d33d0924caee4b7cf5e24b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2348

memory/904-0-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmp

Filesize
4KB

Download
memory/904-1-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/904-3-0x000007FEF57E0000-0x000007FEF617D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-2-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download