8fe145b1d3768a222b033eb00edcdc949177307bd05d996e9931512c2a0771cf

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 05:57

Target

fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe
Size

56KB
MD5

fe98510a23657893402eedf41661ad5d
SHA1

eb4f80cb968b329044cfb0449dbddb268c0d384c
SHA256

8fe145b1d3768a222b033eb00edcdc949177307bd05d996e9931512c2a0771cf
SHA512

a2230e59fe278dfb7695cb41780f5e36e952193c97298fc25bb32648f6e714aac625151668ccb357efb838d05048ee70aef7e815d4927f1fbb47a50777734667
SSDEEP

768:zCN+GgZf0nQrzYOAcSLWR7bkzLN0Ps7jFKvvvvWlogagHWXoiVjCzoX7qI5RF7m9:Hd8nQr0OhBRszLN5JtWXooIoXug7m0+1

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dttooiyyt1.exe	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dttooiyyt1.exe	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2684 wrote to memory of 2860	2684	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	28
PID 2860 wrote to memory of 1200	2860	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	21
PID 2860 wrote to memory of 1200	2860	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	21
PID 2860 wrote to memory of 1200	2860	fe98510a23657893402eedf41661ad5d_JaffaCakes118.exe	21

memory/1200-12-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/1200-14-0x0000000002F50000-0x0000000002F52000-memory.dmp

Filesize
8KB

Download
memory/1200-13-0x0000000002F40000-0x0000000002F43000-memory.dmp

Filesize
12KB

Download
memory/2684-3-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2684-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2684-8-0x00000000003E0000-0x00000000003FF000-memory.dmp

Filesize
124KB

Download
memory/2684-7-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2684-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2684-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2684-2-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2860-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2860-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download