2fa762dfefeffa9e43c294d859e719531418fdfe26b2a8ad9066d9b2f519c45e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 17:34

Target

fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe
Size

35KB
MD5

fad21ce83a91f3a49a307f2c8edaa560
SHA1

2ec95159fc99bc736ccc2540018f4ef144a75719
SHA256

2fa762dfefeffa9e43c294d859e719531418fdfe26b2a8ad9066d9b2f519c45e
SHA512

c0fd248f6d21ce3c6c563934a400c395e5508f9b12d4c632a568cddc34ee14f5ed3cb6ca23c41d1600215d964157911275731ecbf3859ca95a9a4d9edc012b31
SSDEEP

768:HdCEqpsswQ0lJ8bfbh0PjPLXT/7HDvvcR3gnZdQy6rseqsexhQrNjgMj95yu:HMEq3wQk4rs3Twd5j95yu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	notepad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2280	1244	fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fad21ce83a91f3a49a307f2c8edaa560_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2280

memory/1244-5-0x0000000000600000-0x000000000060F000-memory.dmp

Filesize
60KB

Download
memory/2280-0-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/2280-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2280-4-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/2280-6-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/2280-7-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/2280-8-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/2280-9-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download