3198ddffa7b4c47a9014cb3cde9e151e238c0c789feab7b364e4157566473c99

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 19:43

Target

5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
Size

247KB
MD5

5b2056a0021d30840406eec05878fb49
SHA1

3f2733c87ebaf5d3e893cd3292a53c18b3907322
SHA256

3198ddffa7b4c47a9014cb3cde9e151e238c0c789feab7b364e4157566473c99
SHA512

fb271fe546fc7b1d95646ca9d1a189ab716dd22cb673283288a371b759b32daeb279239cfd406d4be399505e904b66de567ef45f7042bf6f638cb83a20db0fab
SSDEEP

6144:1r2zrt906Z1NeY3GUHYVmPKNOABLY501tqAzEPs:9urQ2eYXHYV5YMKPs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93
PID 3456 wrote to memory of 1068	3456	5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5b2056a0021d30840406eec05878fb49_JaffaCakes118.exe"
  2⤵
  PID:1068

memory/1068-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1068-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1068-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1068-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1068-7-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/1068-6-0x0000000002490000-0x00000000024B0000-memory.dmp

Filesize
128KB

Download
memory/1068-5-0x0000000077AF2000-0x0000000077AF3000-memory.dmp

Filesize
4KB

Download
memory/1068-8-0x0000000002490000-0x00000000024B0000-memory.dmp

Filesize
128KB

Download