0a1e58f41e67713d709fd585520dfefd5c6ac675b6e2521e09b5bdd166c74735

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 15:09

Target

d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe
Size

7KB
MD5

d691866dc9ee18429cb1d491ee308ccf
SHA1

3fbc468a194aa26dcb1b1c4c4bc3b052e0841c9a
SHA256

0a1e58f41e67713d709fd585520dfefd5c6ac675b6e2521e09b5bdd166c74735
SHA512

8fc5e59f417ec3f560803eebf488d6f68a3cdf56a009f0836cbfde0719dbd97d4f5a6334e494eca128c4b9fdf5ec662ccbe5e6adec627b2c423f5825cde88937
SSDEEP

96:AamG6kHWjs89JjMWsWrvF5cE2TYlnlYJnLeL0Kff345Cav19RXmm6oajF:A9js8sWFwV2nlYJLeLTg4C6n

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2104	2348	d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2104	2348	d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2104	2348	d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d691866dc9ee18429cb1d491ee308ccf_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2104

memory/2104-2-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x000007FEF5F5E000-0x000007FEF5F5F000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-3-0x000007FEF5F5E000-0x000007FEF5F5F000-memory.dmp

Filesize
4KB

Download
memory/2348-4-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp

Filesize
9.6MB

Download