0336d24fa0764ff5c4d4501194dfdeae56ac43e6b8881827c691f0396478855f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:46

Target

0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe
Size

68KB
MD5

0df225c18912f33705dd327632dfcc1c
SHA1

714c63035a9693d50d0011f406cbdb482a8ee7ef
SHA256

0336d24fa0764ff5c4d4501194dfdeae56ac43e6b8881827c691f0396478855f
SHA512

f2a31bc06aec2c11d15857795699f197ac37ac6283ca56310da61df4bbd4ebc6455c883254a6652c04c934716148f0b9b3dbe668918215bbde68c4abe7b249f1
SSDEEP

1536:n2UDLeo802ba8///KVZ75OCP2WsP6J8J7taXwdofcjsZQ:zeo8nbaRZFrPCyMt+fcwZ

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2ttoddyyti.exe	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2ttoddyyti.exe	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2268	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	28
PID 2268 wrote to memory of 1200	2268	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	21
PID 2268 wrote to memory of 1200	2268	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	21
PID 2268 wrote to memory of 1200	2268	0df225c18912f33705dd327632dfcc1c_JaffaCakes118.exe	21

memory/1180-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1180-1-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1180-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1200-9-0x0000000002FC0000-0x0000000002FC3000-memory.dmp

Filesize
12KB

Download
memory/1200-8-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/1200-10-0x0000000002FD0000-0x0000000002FD2000-memory.dmp

Filesize
8KB

Download
memory/2268-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2268-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2268-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download