f2e8e2e48f7e7055a1537f3fdbc5c6ad286cddaa3e3e8eb27c263e4699327736

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 14:46

Target

cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe
Size

365KB
MD5

cfc8634c32447cbdfc61f9e294ec55c1
SHA1

ca7c99f4e506cc88cb28e9959f9148c981700495
SHA256

f2e8e2e48f7e7055a1537f3fdbc5c6ad286cddaa3e3e8eb27c263e4699327736
SHA512

b53d48aad47a8611e7256ca0459e927f1819d7f6cb7eebb9e097f8a3931f13a67d92f2755fed9bf38970579b713a15b609b5c9ebc74ab4a209d8d7733d1debac
SSDEEP

3072:dY9n7mAWMZed3z6ugCHdaUhf9IiSk2iWSS9OlL/Hr7JjstgUCw/wC/jk5ubr7J7x:uxPo36Yd/hf98k2fN9QhogBC/oSr79M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2856	2340	cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2856	2340	cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2856	2340	cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfc8634c32447cbdfc61f9e294ec55c1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 764
  2⤵
  PID:2856

memory/2340-0-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2340-2-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2340-4-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2340-5-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2856-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download