55824d3e2b4d1179db305025a448310d7e0496257e6a8d3c502aa1ce5ef53655

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 21:36

Target

f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
Size

63KB
MD5

f1fad2961ed4f61b85a1c90ccc14dab9
SHA1

d2dd89e9be79af3ce8c0ff77c390f0718421ca32
SHA256

55824d3e2b4d1179db305025a448310d7e0496257e6a8d3c502aa1ce5ef53655
SHA512

4343b10ddb54b32198839044498f14a36e0e2d19ffb69b41da477d3f58fcc4998233648bdd2d39c7ce2453ee0b060dfdc6829f60840f5979a901e12a9cb58ade
SSDEEP

768:9FFAaEs6GQ4uLFL11zR5ECLkqdimKL7wJ6QM0meicl9b6GvoQsZ3bZ5:9NQBP1z8ykqgR/QM1cl9+GvoQ+bZ5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28
PID 2956 wrote to memory of 764	2956	f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
  2⤵
  PID:764

memory/764-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/764-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2956-1-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Filesize
256KB

Download
memory/2956-2-0x0000000074BE0000-0x000000007518B000-memory.dmp

Filesize
5.7MB

Download
memory/2956-0-0x0000000074BE0000-0x000000007518B000-memory.dmp

Filesize
5.7MB

Download
memory/2956-13-0x0000000074BE0000-0x000000007518B000-memory.dmp

Filesize
5.7MB

Download