2cf845e749b203ab8fa9d78d368965de3ee33822753d8b9ebaab939f83e631f6

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 00:27

Target

f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe
Size

42KB
MD5

f918c9db38219f0f541b68ba924a7bac
SHA1

3acd88630d7dbc035a8c9cb62846cb07066f9b2c
SHA256

2cf845e749b203ab8fa9d78d368965de3ee33822753d8b9ebaab939f83e631f6
SHA512

0a657ee6e53c4ca1816002c21f872d4f1874cc57dc7573cc38e21d290e6dd1433368c5b80d21ffb7d474ccbf61f7b00c3541572edc9a83911917ff3be228cbe0
SSDEEP

768:pzIXe/KSYbzMi5dIikLYtRblI+zIXX+nnCbfIeBcGwBUuzmraMmr1b:lI6KSYbzMidk6Rbl/CAG8Uum41

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e69q1miidu.exe	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e69q1miidu.exe	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe
5104	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87
PID 5112 wrote to memory of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87
PID 5112 wrote to memory of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87
PID 5112 wrote to memory of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87
PID 5112 wrote to memory of 5104	5112	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	87
PID 5104 wrote to memory of 3436	5104	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	56
PID 5104 wrote to memory of 3436	5104	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	56
PID 5104 wrote to memory of 3436	5104	f918c9db38219f0f541b68ba924a7bac_JaffaCakes118.exe	56

memory/5104-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5104-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5112-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5112-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download