9ea363594e90a0e9c0d214e8af1dc5ead746ff5d0e2a9e980ab43970d4130ff5

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 17:37

Target

f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe
Size

88KB
MD5

f875098f47ac7a4a4a8fb5cf508ba1bc
SHA1

fe129000315f9acce06a0e8b6d6284c389609f68
SHA256

9ea363594e90a0e9c0d214e8af1dc5ead746ff5d0e2a9e980ab43970d4130ff5
SHA512

51e65f53600e56a9d5333ae0cf6175aa44042e7aa33529755b3172a0fe70993943690f9f159bf8e07742a1c9a0f9379942f23ac30c9ba1d62ac77b43e135c19d
SSDEEP

768:WOU6hkE22rPtfrtHyeTHwnQXbqkh4WSL/GnKojve+RsnYjkvWjycVp6CVuz:WOUj2fxAKhBOuKoXaSkKpV

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iddy7to1oi.exe	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iddy7to1oi.exe	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3048 wrote to memory of 3024	3048	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	28
PID 3024 wrote to memory of 1188	3024	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1188	3024	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1188	3024	f875098f47ac7a4a4a8fb5cf508ba1bc_JaffaCakes118.exe	21

memory/1188-11-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1188-12-0x0000000002AB0000-0x0000000002AB3000-memory.dmp

Filesize
12KB

Download
memory/1188-13-0x0000000002AC0000-0x0000000002AC2000-memory.dmp

Filesize
8KB

Download
memory/3024-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3024-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3024-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3048-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download