ec31d8619ca87735a7000e9537b3ac1c2e5cc5339e77306ab45520ca864d729d

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:31

Target

0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
Size

534KB
MD5

0e41fc22686b5c0d286296fffad2cb37
SHA1

eb521a724bad3b70f28cbe02d0ccaa76f0325623
SHA256

ec31d8619ca87735a7000e9537b3ac1c2e5cc5339e77306ab45520ca864d729d
SHA512

7a930013c808045b5188f69d2793ef0a228a7a76ca008ab10d227285af20689d5426aa2776c89f9661348c15aebaf8ab9a2125abc64486ac61eee1eb8e748c10
SSDEEP

12288:x1u88Yx8IpL0a42P3a5Bip6HwgxxEmHVK9ui:OEXpd6xRw9ui

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4588 set thread context of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82
PID 4588 wrote to memory of 3116	4588	0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0e41fc22686b5c0d286296fffad2cb37_JaffaCakes118.exe"
  2⤵
  PID:3116

memory/3116-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-9-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-10-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-12-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3116-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3116-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4588-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download