39c73c4e18d8da48ffec11261d85b1a181fcafa74f3256ca63dd42923ddf8483

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 10:12

Target

e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe
Size

69KB
MD5

e73863406077460ce69b9b025670f8f9
SHA1

18ed6cb24c94b1c090b1bd54c8fd4344708a5bd5
SHA256

39c73c4e18d8da48ffec11261d85b1a181fcafa74f3256ca63dd42923ddf8483
SHA512

e6c894f8d59804f84e29daa2b3bf87eda39585ae11d6761449b6a52428e5146fc9653be31f59f910f0cf950dc64c0b2d640e89aa8ece12f278d7e7a5aef64c40
SSDEEP

768:GgCIGhxgLa1J+9ZWDnBwPQdCgVpudGnsi94+WW/r0va0Mvrr4Ink+JU2zbH3vZLP:GVLheLaUZW0tgVp2+WQrtcILprBLYk

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1884	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1884	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe
1884	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1884	4952	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	87
PID 1884 wrote to memory of 2760	1884	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	90
PID 1884 wrote to memory of 2760	1884	e73863406077460ce69b9b025670f8f9_JaffaCakes118.exe	90

memory/1884-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1884-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1884-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1884-6-0x00000000778A2000-0x00000000778A3000-memory.dmp

Filesize
4KB

Download
memory/1884-9-0x00000000778A2000-0x00000000778A3000-memory.dmp

Filesize
4KB

Download
memory/1884-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2760-8-0x00007FF692AA0000-0x00007FF692F3D000-memory.dmp

Filesize
4.6MB

Download
memory/4952-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4952-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download