5ca8eeb395f30b3bb122e9b0762cdcc875d4bf3a3c16645830847177f643ccf2

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 21:59

Target

0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe
Size

225KB
MD5

0ad51329cbba85acefc578dce1c739e7
SHA1

e140e01491b9e20c8a7516f46f4351771101ce17
SHA256

5ca8eeb395f30b3bb122e9b0762cdcc875d4bf3a3c16645830847177f643ccf2
SHA512

b81b0f4fc28db3dc74f4187bd17eff71641604d8714e1894d3c8fde4beeb9b81cf4bd8cbf691336895132c714a1475cb5eb10e5df98b224f2bf09c37c92186bb
SSDEEP

6144:VaRJdqdnEjYuNWEWHtzqTIpbNKHk4mA1tOJyK6JgmYf:0RJdqdnEsjhmTIpb6Yz6cf

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3872 set thread context of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88
PID 3872 wrote to memory of 1668	3872	0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0ad51329cbba85acefc578dce1c739e7_JaffaCakes118.exe
  2⤵
  PID:1668

memory/1668-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1668-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1668-4-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/1668-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3872-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download