c4e198c3ace0bfa32373a804498192fcf514c1c06bacadb71c35106a35b2c4a6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 22:09

Target

2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe
Size

61KB
MD5

2667f35f9c189ec3f488410d9fdbd905
SHA1

8814e2c3c50889aeb0665f1fdc3a7a4e9ec403b3
SHA256

c4e198c3ace0bfa32373a804498192fcf514c1c06bacadb71c35106a35b2c4a6
SHA512

743554d7e749ac69c518407ac346973ec1fa44e7b75dc0a715daea9683717e113f0cb2166b09a6d0ba4acb0e8e998ab8905a5e9191c9c4cd35b0d0216489e62a
SSDEEP

1536:hip5gsoN2nsUGOpfE1H2v60cZS+OmOy8twxaOaPmXRX:Up3oN2n/GOJqrXZolsaOOmh

Score

7^/10

pid	process
1508	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe

description	pid	process	target process
PID 2208 wrote to memory of 1508	2208	2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe	cmd.exe
PID 2208 wrote to memory of 1508	2208	2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe	cmd.exe
PID 2208 wrote to memory of 1508	2208	2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe	cmd.exe
PID 2208 wrote to memory of 1508	2208	2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2667f35f9c189ec3f488410d9fdbd905_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Desktop.bat
2⤵
- Deletes itself
PID:1508

C:\Users\Admin\AppData\Local\Temp\Desktop.bat
Filesize
257B

MD5
9b2873abfe8b0d142a429f7ce089fcce

SHA1
494422605ca5e84580ab56c318353a007821718b

SHA256
bf895f0a869a0aff920085c14d589af56fb358419a85db0462e412981dfd155d

SHA512
0751b177d8509c8ff6e384f885a9b30d836fa77bd4dc93efc6225afff622f2a86f5c1d381d67a66dbd5322ecb758b12ada32ba48c6aa6f58d7369331b4464c67

Download Submit
memory/2208-7-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download