b7999442b480609a7d0fa91a356a26622c8084fcb7cfc9665e5aae278f3ced48

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 16:44

Target

c9369f97234356df87d940987599e330_JaffaCakes118.exe
Size

84KB
MD5

c9369f97234356df87d940987599e330
SHA1

a072acf578fbd875844e7f9337a68358388f4d89
SHA256

b7999442b480609a7d0fa91a356a26622c8084fcb7cfc9665e5aae278f3ced48
SHA512

2cec2d5d11be8adef4ff5bf3362435af869f959cdd8a9e719f662a83ca6c5221497d61170a9ee4930763a36a0932f96247a6bdd060d3201439964b58ad08df27
SSDEEP

1536:15nrDHrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrra:15nrDHrrrrrrrrrrrrrrrrrrrrrrrrra

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1948	1756	c9369f97234356df87d940987599e330_JaffaCakes118.exe	30
PID 1756 wrote to memory of 1948	1756	c9369f97234356df87d940987599e330_JaffaCakes118.exe	30
PID 1756 wrote to memory of 1948	1756	c9369f97234356df87d940987599e330_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c9369f97234356df87d940987599e330_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9369f97234356df87d940987599e330_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:1948

memory/1756-0-0x000007FEF58FE000-0x000007FEF58FF000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1756-2-0x000007FEF5640000-0x000007FEF5FDD000-memory.dmp

Filesize
9.6MB

Download