11b7abac6e3d1600dc41efe96ff18a0f75b41cd36d50c55d403de7c02b931579

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 05:12

Target

f06432f984f0006891aef9023df6680f_JaffaCakes118.exe
Size

220KB
MD5

f06432f984f0006891aef9023df6680f
SHA1

b3d4f801fda92234af1db77dc38ccc004ad86fe9
SHA256

11b7abac6e3d1600dc41efe96ff18a0f75b41cd36d50c55d403de7c02b931579
SHA512

7019cfc6900a0ac84d55d7586139034d90a0b7513039ece9380a3f0e75cdff0826662533b247f5b836ce164ee4d77351299be7c3cd381baa840e07f0db7acca1
SSDEEP

96:Pqb+XpkJDo13pmW7xjwackoWrzO1LsxUxbK:SbYichpmOwackoWrOx+

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2356	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2356	1044	f06432f984f0006891aef9023df6680f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f06432f984f0006891aef9023df6680f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f06432f984f0006891aef9023df6680f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe C:\Users\Admin\AppData\Local\Temp\f06432f984f0006891aef9023df6680f_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2356

memory/2356-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2356-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download