229d10f245741e09aa49f0fde9e6d8273cd6e045620667c4d74767c50026d73b

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 09:18

Target

12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe
Size

492KB
MD5

12bda8ba1c3bfb26500c153b33e48400
SHA1

419e7f6f8ea31267fa0eeacf932d24df076a4535
SHA256

229d10f245741e09aa49f0fde9e6d8273cd6e045620667c4d74767c50026d73b
SHA512

11bff576db7dd612d0b557df6280bf4ccce5ea4c3166c20839079e63b9092084f672eb08c6e60f501ce877c741247faf895d97d348cf27b1ba6537b300bb068e
SSDEEP

3072:RfoMAGJ0SGzFgekVTjA4u6p6sZ1HPD0C4XoB:2lSuGnVTjjuGDXvDy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2236	2368	12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe	29
PID 2368 wrote to memory of 2236	2368	12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe	29
PID 2368 wrote to memory of 2236	2368	12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12bda8ba1c3bfb26500c153b33e48400_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 412
  2⤵
  PID:2236

memory/2236-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2368-0-0x000007FEF5EFE000-0x000007FEF5EFF000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-2-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-4-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download