022c83c242e1a3adcdd0bd49e2a2ba3231d7f6604cf92be73bc7c3e0d2721f60

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 08:25

Target

f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe
Size

14.7MB
MD5

f0a86bd452d84dabd75a1d18645ed7e9
SHA1

cfab0cb3476dd6ba84d0fef0edbf075e428b4345
SHA256

022c83c242e1a3adcdd0bd49e2a2ba3231d7f6604cf92be73bc7c3e0d2721f60
SHA512

903b36308a9d41415da467e1d8ce7550d75df4d0daf481bbe165fe4829d62e9d83dd661d3f2807a6a2facdc2f5442751bf5ed6ab56dc1285872bf88b3942297b
SSDEEP

1536:+fqRycqYoVCkakIle26DyiWgecCh5Btna2Edc+hQgjTYC0p0FelvP1ZUb3Uy:LyzXVC1exD2VcKLEm5RB0klvIU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 840 set thread context of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28
PID 840 wrote to memory of 1112	840	f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0a86bd452d84dabd75a1d18645ed7e9_JaffaCakes118.exe
  2⤵
  PID:1112

memory/1112-8-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-2-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-10-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-11-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-12-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download