86cf4b9b23ee85f78ba3324665633444772a33a7f7d25f463a06d9d56bd0f816

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 18:41

Target

fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe
Size

1.3MB
MD5

fce9b56cdd4d3122f3a7dc6a907d8c5a
SHA1

ebe88af4d5c8a8d7da2daa218b21b34e58fdcc37
SHA256

86cf4b9b23ee85f78ba3324665633444772a33a7f7d25f463a06d9d56bd0f816
SHA512

94f6cdbe25f1937fa8260de3bce1d716f9e225d5236293ed03f55ad8d95a7207050cd9e0d85538f31a6c7aa359e1eebe9d03fb551ba24f4a719f5e11b5a554b2
SSDEEP

24576:tlzelnCjGZG+WNYEP7yt0CVGRQwAkC4EQ6Vw1we3zi2B8Ol1hlyJ5:rylnZGBzjMboRQlkC4EQ6iwSb1hED

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2788	2092	fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2788	2092	fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2788	2092	fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fce9b56cdd4d3122f3a7dc6a907d8c5a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  PID:2788

memory/2092-0-0x000007FEF575E000-0x000007FEF575F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2092-2-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2092-4-0x000007FEF575E000-0x000007FEF575F000-memory.dmp

Filesize
4KB

Download
memory/2092-5-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2788-3-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download