0c98fa95157a4d17c988a939092cb781bfe145a2ca22c35acb647676e5602c4c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 16:54

Target

09b735113336a30dbae68b949c9230db_JaffaCakes118.exe
Size

50KB
MD5

09b735113336a30dbae68b949c9230db
SHA1

eeac77fdec2e1edf0f1b419d656104d04e570fe4
SHA256

0c98fa95157a4d17c988a939092cb781bfe145a2ca22c35acb647676e5602c4c
SHA512

b0a3b83a7c48c9149fcc611c1b7ec21f664219462225f0a1cb1b238b4b3e0c786cc0cb3b4327c813fdd132bf946d6708d22531cab81cbf0a21341e9645ee9afb
SSDEEP

1536:/rUUD3CPW/9m6e6mm/ASwwb5+JUgmIW1P:TFDSO/9he69/Xwwb5+JUgg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28
PID 1728 wrote to memory of 1712	1728	09b735113336a30dbae68b949c9230db_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\09b735113336a30dbae68b949c9230db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09b735113336a30dbae68b949c9230db_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\09b735113336a30dbae68b949c9230db_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\09b735113336a30dbae68b949c9230db_JaffaCakes118.exe
  2⤵
  PID:1712

memory/1712-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1712-4-0x0000000000400000-0x0000000000401E00-memory.dmp

Filesize
7KB

Download
memory/1712-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1728-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download