ee3ea2cd54da5b90b2978a65b09ae33033afa6c2a6455b8ef6bf9529f7568a02

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 14:29

Target

0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe
Size

48KB
MD5

0e6b3435678c8498c5209fd284686a3e
SHA1

31369a35c2f4edf75518af24425738fc2c7f18c5
SHA256

ee3ea2cd54da5b90b2978a65b09ae33033afa6c2a6455b8ef6bf9529f7568a02
SHA512

31d00c7e62bfd5869f37ff02a4d3318e486064366c72ef9a8c631488b03a17bf62cd5230419c75945bae3438aac5c1fe6eb1bce95473f857d924d9fc89484a6a
SSDEEP

1536:MsmE1nefqKcq+oPmib863gbNsKzZnZO8W:/LKcqEiblgbNxZo

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe
2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2044 wrote to memory of 2400	2044	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	28
PID 2400 wrote to memory of 1224	2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	21
PID 2400 wrote to memory of 1224	2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	21
PID 2400 wrote to memory of 1224	2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	21
PID 2400 wrote to memory of 1224	2400	0e6b3435678c8498c5209fd284686a3e_JaffaCakes118.exe	21

memory/1224-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1224-15-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2400-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2400-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download