7209bce9c39bb8fcaeffe89ff3f4dd0924bb8ebcc4e8412dcf05d9342db4fda3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 05:25

Target

d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe
Size

7KB
MD5

d12c32b814ca597b2c44aad4715ac443
SHA1

510c7b5f04f1de94c9a3879b34991f79e97c1566
SHA256

7209bce9c39bb8fcaeffe89ff3f4dd0924bb8ebcc4e8412dcf05d9342db4fda3
SHA512

432a200c13036a79ff6a16aa6afff56ff00bf85d28c108837c940031ee53f0617109d0e7978c3f130feca483aa5d617e5b241715783d7c1970beb8c5674f546f
SSDEEP

96:+gQG6kHWjs8F7TssS61vF5cE2TYlnlYJnLeL0Kff345COyv1r5RXmm6oajF:+Zjs8NvS61wV2nlYJLeLTg4zn6n

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2756	2236	d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2756	2236	d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2756	2236	d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d12c32b814ca597b2c44aad4715ac443_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2756

memory/2236-0-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2236-2-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2236-4-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2236-5-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/2756-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download