4c0dd911d8ef226e5540d537a1c469d6d9a70868ecec9bd927155189b6120cda

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 06:40

Target

fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe
Size

20KB
MD5

fbb6a5f382ebd826415f7b2e8d5dac91
SHA1

5c801e3c500cc5a5ee19b8870c2a236be68fe62c
SHA256

4c0dd911d8ef226e5540d537a1c469d6d9a70868ecec9bd927155189b6120cda
SHA512

6f03251ece4b49655f212498f4b838db3a7f6590a82a7977174acb3ba028110a7101d5553b7a5c7c3d8a9287fb5cf61e6ed205d4a24720eec05b673f55dd0222
SSDEEP

384:9wkuLTBp9nLrIyuyKXbqD6L724jcPlZ1+dNORyn+K6UEYIR:9wkuhrIZ6GBcPTO+1R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2092	1656	fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2092	1656	fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2092	1656	fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbb6a5f382ebd826415f7b2e8d5dac91_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 376
  2⤵
  PID:2092

memory/1656-0-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/1656-3-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2092-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download