472469f8f68eb0ea7abe6d9f309d5bf0b1d004ce4279b57600dd0907f6a40a98

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 19:13

Target

fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe
Size

32KB
MD5

fd7230bde7c4de4f3aa4f22f5078851c
SHA1

d6f26ae41229665ab2b7bd84a47a595beea4009d
SHA256

472469f8f68eb0ea7abe6d9f309d5bf0b1d004ce4279b57600dd0907f6a40a98
SHA512

7e1a118e1fddb1691bc8b97e9ff14618ca7a5aa64fa37bdae170a54bc407cedd0fb6c848dbe7e231110a1cc38731317999c577257ead8580907cceaf6ef21871
SSDEEP

768:f+JS71pvXry+vvYgDGoB+Uu0jCDiPzIe4kueOBiuOU:2oD2aYWvStkudQu1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2908	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28
PID 1620 wrote to memory of 2908	1620	fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fd7230bde7c4de4f3aa4f22f5078851c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2908

memory/1620-17-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/2908-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-2-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-10-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2908-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download