65664e259ff0d197ff858fa5ea871aaebb9a710a34c54ef81fd4e90cf94069cb

Analysis

max time kernel
100s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 00:59

Target

c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe
Size

7KB
MD5

c7f5a5dc6609ba7482a9ae95c614f727
SHA1

9399f50ee8617e03d08dc903a8f66d3fd3b416bf
SHA256

65664e259ff0d197ff858fa5ea871aaebb9a710a34c54ef81fd4e90cf94069cb
SHA512

5062f5ca7c6264b079ad5ad212da44e91bbeec76fba9b961a3032b6dfae7136f1c4f2b4c0058936bd1239349dd6620dd37d7fda161bd43c6fc885d1abc7d4370
SSDEEP

96:IgQG6kHWjs8F7TssS61vF5cE2TYlnlYJnLeL0Kff345CLv1r5RXmm6oajF:IZjs8NvS61wV2nlYJLeLTg4Rn6n

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2184	860	c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe	31
PID 860 wrote to memory of 2184	860	c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe	31
PID 860 wrote to memory of 2184	860	c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7f5a5dc6609ba7482a9ae95c614f727_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2184

memory/860-3-0x000007FEF615E000-0x000007FEF615F000-memory.dmp

Filesize
4KB

Download
memory/860-1-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

Filesize
9.6MB

Download
memory/860-0-0x000007FEF615E000-0x000007FEF615F000-memory.dmp

Filesize
4KB

Download
memory/860-4-0x000007FEF5EA0000-0x000007FEF683D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-2-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download