c7fc3d04cb78225ee34f0f1b5219b5c128085cde20b93335bb280c427004b6d8

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 19:46

Target

b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe
Size

7KB
MD5

b8e824f25310636bf1ebea362b4592db
SHA1

2d5320dea29fb4374eacd0466599f9c3c489ef6b
SHA256

c7fc3d04cb78225ee34f0f1b5219b5c128085cde20b93335bb280c427004b6d8
SHA512

c2772a57f627e6ecff534242a35fa50e89990f4d8fd78a2356fa0accb02c0a9c42f278275663a9cdde8d8108f71bba9fe77f87c3a38fa89fdea3c9fb14ee1d05
SSDEEP

96:RkoG6kHWjs89JjMWsWrvF5cE2TYlnlYJnLeL0Kff345CO4v19RXmm68ajF:Rljs8sWFwV2nlYJLeLTg4Ow6T

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2520	1072	b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe	30
PID 1072 wrote to memory of 2520	1072	b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe	30
PID 1072 wrote to memory of 2520	1072	b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8e824f25310636bf1ebea362b4592db_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2520

memory/1072-0-0x000007FEF588E000-0x000007FEF588F000-memory.dmp

Filesize
4KB

Download
memory/1072-1-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1072-2-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/1072-4-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-3-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download