ec31d8619ca87735a7000e9537b3ac1c2e5cc5339e77306ab45520ca864d729d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 13:31

Target

0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
Size

534KB
MD5

0e41fc22686b5c0d286296fffad2cb37
SHA1

eb521a724bad3b70f28cbe02d0ccaa76f0325623
SHA256

ec31d8619ca87735a7000e9537b3ac1c2e5cc5339e77306ab45520ca864d729d
SHA512

7a930013c808045b5188f69d2793ef0a228a7a76ca008ab10d227285af20689d5426aa2776c89f9661348c15aebaf8ab9a2125abc64486ac61eee1eb8e748c10
SSDEEP

12288:x1u88Yx8IpL0a42P3a5Bip6HwgxxEmHVK9ui:OEXpd6xRw9ui

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2216	2232	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe"
  2⤵
  PID:2216

memory/2216-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-26-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2216-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-16-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-4-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-27-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2216-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2216-10-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2232-23-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download