c5095774e6fc9813fe00408f84791557ff9e28ba1269745fb298c8a6b89a834b

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:24

Target

191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe
Size

353KB
MD5

191a6b87a4cfde43c418f8d3f8125dd4
SHA1

11caaae4b81e32475880bbb6162f36395ae3fd47
SHA256

c5095774e6fc9813fe00408f84791557ff9e28ba1269745fb298c8a6b89a834b
SHA512

16d781edab16408f5b45aa72f80e6cb03f4da22e4efb5ca3a1cc4114c2ddba7e03bc926696ade04a0e03b310f7a1fbb3b519a36a2fdcce64af71c21015dcfbb4
SSDEEP

6144:e36wMPKotBFuFq/4b0OQ6iQHWSRpjvpyoWlRlDqDjl4AFyO7Qk79VulTweZ5q:SEPBF5/4c6ifSRPFWlRl2t4AyiQGA8eq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3996 set thread context of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85
PID 3996 wrote to memory of 2612	3996	191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\191a6b87a4cfde43c418f8d3f8125dd4_JaffaCakes118.exe"
  2⤵
  PID:2612

memory/2612-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2612-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2612-6-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2612-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3996-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3996-4-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download