d124ed7810a97f04a88856b695e5c37b5562c8ea777b43b01ef0b5b9f5c9b61d

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 12:31

Target

1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe
Size

476KB
MD5

1603f4ce9f63d0484d9a6ae20b90d197
SHA1

48b9da276d8f0a7dbe905862f90b30e730ac52e6
SHA256

d124ed7810a97f04a88856b695e5c37b5562c8ea777b43b01ef0b5b9f5c9b61d
SHA512

0ba228a6b5bb1d64a655bcab3da5c516271a7169e13a00973d244bbae4a7402d7bb40dbb88acdbbf8f3804fadad393e49b6e9466c055c2454f6ee1039d29064a
SSDEEP

6144:JJZv5zFiIO558RLSyho0BZTcjqaEUNGud3cK:7LFKKRmyho0XTc+aEUNGudZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1603f4ce9f63d0484d9a6ae20b90d197_JaffaCakes118.exe"
  2⤵
  PID:3004

memory/3004-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-10-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-8-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download