a6d36b49e8db816a2da47f5ecbb38933e4e215d96be806e65a4a5c57ecc3985e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 00:39

Target

e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe
Size

1.6MB
MD5

e15c4453763cbc159e75791a54cffd4f
SHA1

ef4d37e7e2eed95e977cf1a00f2e7ae87ba1ee4f
SHA256

a6d36b49e8db816a2da47f5ecbb38933e4e215d96be806e65a4a5c57ecc3985e
SHA512

a188a7f780cac2b1b5ea28c0a46ccb48e42f9e56be61af5b1b624604d638c4245beef4a664dcacf940c8777af09b627bf4b2c1464a81d8102a63b6f7e15f94b3
SSDEEP

24576:2IWriVc8iHNFphPIWriI57c9IW1dXgfC/MHmg:3WIc8MNFgWJc9IW1dXgfC/MHmg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2256	548	e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe	31
PID 548 wrote to memory of 2256	548	e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe	31
PID 548 wrote to memory of 2256	548	e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e15c4453763cbc159e75791a54cffd4f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 468
  2⤵
  PID:2256

memory/548-0-0x000007FEF602E000-0x000007FEF602F000-memory.dmp

Filesize
4KB

Download
memory/548-1-0x0000000001E80000-0x0000000001EA7000-memory.dmp

Filesize
156KB

Download
memory/548-2-0x0000000001EB0000-0x0000000001EF5000-memory.dmp

Filesize
276KB

Download
memory/548-3-0x000000001AB40000-0x000000001ADBC000-memory.dmp

Filesize
2.5MB

Download
memory/548-4-0x0000000001F00000-0x0000000001F0C000-memory.dmp

Filesize
48KB

Download
memory/548-5-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/548-6-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/548-7-0x000000001AA90000-0x000000001AABE000-memory.dmp

Filesize
184KB

Download
memory/548-9-0x000007FEF5D70000-0x000007FEF670D000-memory.dmp

Filesize
9.6MB

Download
memory/2256-8-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download