dcb9f8920a0bbd77d6e6546bb41cb76200f16026b1a3f097a8bf3ad5852a3efb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:47

Target

f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe
Size

90KB
MD5

f8d0d71b4d18a3ce0339c5fdac67e977
SHA1

bf5a2f1c4eabba2eba2fb1bd191f92078ec40fb2
SHA256

dcb9f8920a0bbd77d6e6546bb41cb76200f16026b1a3f097a8bf3ad5852a3efb
SHA512

b89b309935a8ba801e4a479cf02ba0ed57be57834d4f4bdd75ec219e2590ab77c7163f8828df6876c21179500d825d328ceabe46d291f8490b261760b0ff9649
SSDEEP

1536:U1UnLApmGtiH+MpJc+8JhXlR9ceq3zDv+z0TtSuoLPNSZRc:UxEHJdMhXtY/MPQbc

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe
1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1620	2188	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	28
PID 1620 wrote to memory of 1192	1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	21
PID 1620 wrote to memory of 1192	1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	21
PID 1620 wrote to memory of 1192	1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	21
PID 1620 wrote to memory of 1192	1620	f8d0d71b4d18a3ce0339c5fdac67e977_JaffaCakes118.exe	21

memory/1192-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1192-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1620-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1620-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1620-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download