3198ddffa7b4c47a9014cb3cde9e151e238c0c789feab7b364e4157566473c99

Analysis

max time kernel
129s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 19:43

Target

5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
Size

247KB
MD5

5b2056a0021d30840406eec05878fb49
SHA1

3f2733c87ebaf5d3e893cd3292a53c18b3907322
SHA256

3198ddffa7b4c47a9014cb3cde9e151e238c0c789feab7b364e4157566473c99
SHA512

fb271fe546fc7b1d95646ca9d1a189ab716dd22cb673283288a371b759b32daeb279239cfd406d4be399505e904b66de567ef45f7042bf6f638cb83a20db0fab
SSDEEP

6144:1r2zrt906Z1NeY3GUHYVmPKNOABLY501tqAzEPs:9urQ2eYXHYV5YMKPs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28
PID 1676 wrote to memory of 2960	1676	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe"
  2⤵
  PID:2960

memory/2960-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-14-0x0000000000150000-0x0000000000170000-memory.dmp

Filesize
128KB

Download
memory/2960-15-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download