b36c6862b80ab4bd01dd80bb1f348d75798e3b1e0ae635a3d0c1bbe19fc0daba

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 20:33

Target

fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe
Size

176KB
MD5

fadd3068313adab34bb197ef12f68489
SHA1

db747a4150f7a63667fecc22ee895bd9967e2d4d
SHA256

b36c6862b80ab4bd01dd80bb1f348d75798e3b1e0ae635a3d0c1bbe19fc0daba
SHA512

8a053345cd23c8fe32bdad6536fbba5ed47bdc0bacacdd60443fac39460d4236dbb1c04feeceacdd37b2f2f7db46c2c7c5e46e7ac9710c04641bc2ee78c6a56f
SSDEEP

3072:1amaEfmcxtNx8oVVwaOQLmc0qBh8vbzUEUkkO6xJZ9KIJ:smawtDV+bf5b5p6L3K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1192	1984	fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe	30
PID 1984 wrote to memory of 1192	1984	fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe	30
PID 1984 wrote to memory of 1192	1984	fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fadd3068313adab34bb197ef12f68489_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  PID:1192

memory/1192-5-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/1984-0-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1984-2-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1984-3-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1984-4-0x00000000002F0000-0x0000000000304000-memory.dmp

Filesize
80KB

Download
memory/1984-6-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1984-7-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download