593cff3f581521130c278f9cea06d171a7123f818750a01aa1823d2fd6954b99

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 06:08

Target

3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
Size

28KB
MD5

3e381a6a29ba0fddd97c873f96928d61
SHA1

9d759988100e52fc5259efa0308b924b15d43657
SHA256

593cff3f581521130c278f9cea06d171a7123f818750a01aa1823d2fd6954b99
SHA512

861c19ad9c9b36450443b34f48b847ed9c75c6a933e7e05c3f4824e3497a7d7120f96f0664af29c4a16e294e474a5d47b1d3edf4eb6f8358d9267dc92a5d5575
SSDEEP

384:UmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J14:hUjKVjl9xw3x6nz7vj1wrK

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe
1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21
PID 1624 wrote to memory of 1268	1624	3e381a6a29ba0fddd97c873f96928d61_JaffaCakes118.exe	21

memory/1268-1-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1268-9-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1624-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1624-4-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1624-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download