2e0007f1350ad9b5f0fdd5d4fcf726ff0a406b4ea55e75b826cf50b149759386

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 08:34

Target

077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe
Size

102KB
MD5

077a09951c980fb42e02e7fa82531c6f
SHA1

dc923be16ee8d31f834dffb1b14a49d1aa236368
SHA256

2e0007f1350ad9b5f0fdd5d4fcf726ff0a406b4ea55e75b826cf50b149759386
SHA512

212b10fe41c771536a4b718a254589e299f45bccc131f4ca106f812f067ea76832f5bb51af7fd7550fd01dbb6797da004277a3fe33f82552a5ca05a3820d7495
SSDEEP

1536:sV9+mRw7a7hHEyU/zhacXIMZsUEoth8ghVHjLn+czirkH78QnvNJFq0CIzr0bJ:smAwEhHNIzwMZsU0g/DLcrXEq0CIzAl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2192	2984	077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\077a09951c980fb42e02e7fa82531c6f_JaffaCakes118.exe
  2⤵
  PID:2192

memory/2192-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-0-0x00000000742D1000-0x00000000742D2000-memory.dmp

Filesize
4KB

Download
memory/2984-1-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2984-2-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download
memory/2984-10-0x00000000742D0000-0x000000007487B000-memory.dmp

Filesize
5.7MB

Download