5839d2af545113faec140c3e79f41ba83bdca4ed6b7a4978768c98fbdc99b7fa

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 03:03

Target

2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
Size

280KB
MD5

2d06ca24a0ebb1ede316a6340d92cebd
SHA1

37499d29889dc73d2f8fc3af452b586a7b176451
SHA256

5839d2af545113faec140c3e79f41ba83bdca4ed6b7a4978768c98fbdc99b7fa
SHA512

71a3529da1b2575e65919cce03fd90dd61f6c8cc6566580a285e50b729aa410b45081d2136231825708546271f1368cad869c5dc1513ba39e62ddcc034ac0634
SSDEEP

6144:o66eOg53/K/XBfwJzmVLFjEC95DIaciEorfGZIYE:oJw53/4B84Zjn9VIacijrGZDE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe

description	pid	process	target process
PID 2904 set thread context of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe

description	pid	process	target process
PID 2904 wrote to memory of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
PID 2904 wrote to memory of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
PID 2904 wrote to memory of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
PID 2904 wrote to memory of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
PID 2904 wrote to memory of 2680	2904	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe	2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d06ca24a0ebb1ede316a6340d92cebd_JaffaCakes118.exe"
2⤵
PID:2680

memory/2680-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-0-0x0000000074481000-0x0000000074482000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-2-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-6-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2904-7-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download