b9ff07d7f00388f8bdd52ff242e5a89dd6f42391c9bfa06880606befa8e0eda6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 20:58

Target

f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe
Size

7KB
MD5

f09984effe9f171b3c38df49d24d2890
SHA1

8966cd34062bb21b26fd372f0f4a175825e8c4da
SHA256

b9ff07d7f00388f8bdd52ff242e5a89dd6f42391c9bfa06880606befa8e0eda6
SHA512

0ebf393ecd51b923d69764c2561b4156629389535e8c11d2900b14075f40503b4f49dfed03781a9fd33fabff23d2952c85b4ac8825a66088b0045b2c663220f8
SSDEEP

96:6SmG6kHWjs8FE2tMWsWrvF5cE2TYlnlYJnLeL0Kff345CQv1r5RXmm6CBajF:6Fjs8J6WFwV2nlYJLeLTg4on6CS

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3040	1984	f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe	31
PID 1984 wrote to memory of 3040	1984	f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe	31
PID 1984 wrote to memory of 3040	1984	f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f09984effe9f171b3c38df49d24d2890_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3040

memory/1984-0-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1984-3-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/3040-2-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/3040-4-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download