7b6b1e86c0de2efda1666b58fa7d43bc0eac2914f5f3eb19bc82c845e5a53b10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 13:11

Target

064ab238296459379ae09891e3063b15_JaffaCakes118.exe
Size

86KB
MD5

064ab238296459379ae09891e3063b15
SHA1

09851256ed8a8bf927551416ef847fff8ddc49f9
SHA256

7b6b1e86c0de2efda1666b58fa7d43bc0eac2914f5f3eb19bc82c845e5a53b10
SHA512

42a4ecf100cf4bb502c90c9ec0ae1847167517baaf2c3efb854fc96127461cb459199ebcc035150da646b269a91a78c7ae61e749c7673e13958e24f2fcb051a6
SSDEEP

1536:MBjslXVB1WRydFMQacilWJ6VY0iEbOasbO4Wx4RcRqDRoQU8+FTXe4oTTtE18fNt:MBEn6QRoQUHXe4oTTtvNio/YU+2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2376	1644	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe"
  2⤵
  PID:2376

memory/1644-11-0x0000000019140000-0x000000001915B73C-memory.dmp

Filesize
109KB

Download
memory/2376-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2376-7-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2376-4-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2376-2-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2376-0-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download