18b2f38c09e1cf7fbd273694072a8a1a49cca258ecb0de821f06e54a2db0011f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 15:36

Target

07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe
Size

1.1MB
MD5

07597e94728032cccf58be1a1f048c1f
SHA1

e118d2486e04edd10c291c59f0f38cc2fdc23e50
SHA256

18b2f38c09e1cf7fbd273694072a8a1a49cca258ecb0de821f06e54a2db0011f
SHA512

c5782732b640dffe1dfbcd9404688ed046f739d54acdd66c00316257202c82aebec88377d784f08a01f4ff56d6af2be0640e4834242720c045f43eb7186c4cee
SSDEEP

24576:GaV17Bk8wh1C0YZVeEODFn+7RPpw/o2Fadr3NtrdiTy8vOjXbbOxRmfmGq:GgNtxZVehhn+7RBsFerrdi6Xe/mfg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe
2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2204	2016	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	28
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21
PID 2204 wrote to memory of 1248	2204	07597e94728032cccf58be1a1f048c1f_JaffaCakes118.exe	21

memory/1248-14-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1248-21-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2016-12-0x0000000010001000-0x000000001000B000-memory.dmp

Filesize
40KB

Download
memory/2016-3-0x0000000010001000-0x000000001000B000-memory.dmp

Filesize
40KB

Download
memory/2016-11-0x0000000010000000-0x000000001012E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-0-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2016-2-0x0000000010000000-0x000000001012E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-1-0x0000000000330000-0x0000000000422000-memory.dmp

Filesize
968KB

Download
memory/2204-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2204-17-0x0000000010000000-0x000000001012E000-memory.dmp

Filesize
1.2MB

Download
memory/2204-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2204-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2204-33-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download