d0ed2f89829e284be82abff05d0f4709ac17c660c87a93244a1dbb840e07623b

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:31

Target

19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe
Size

104KB
MD5

19203eb2d4567a70604f9f63750801f8
SHA1

0bb29f3c962ba0612572243bbebb895ef12d5659
SHA256

d0ed2f89829e284be82abff05d0f4709ac17c660c87a93244a1dbb840e07623b
SHA512

a1167b7021cd6c8d60353aea522a165965d761f137d8f99789fa9318b6e628e8e018b36b030900602eec49b2348c05d2f94fb596b67de4d4e1709c4b678fb524
SSDEEP

3072:NnWi5n7nGIBSyQZFXhrsv43I6OW0fRsbNAO8B9Ni5byeI:NWgnQ0N6558Bb6K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1804 set thread context of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83
PID 1804 wrote to memory of 1384	1804	19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\19203eb2d4567a70604f9f63750801f8_JaffaCakes118.exe
  2⤵
  PID:1384

memory/1384-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1384-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1384-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1384-12-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/1384-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1804-0-0x0000000000400000-0x0000000000432AA0-memory.dmp

Filesize
202KB

Download
memory/1804-2-0x0000000000400000-0x0000000000432AA0-memory.dmp

Filesize
202KB

Download
memory/1804-1-0x0000000000401000-0x0000000000415000-memory.dmp

Filesize
80KB

Download
memory/1804-7-0x0000000000400000-0x0000000000432AA0-memory.dmp

Filesize
202KB

Download
memory/1804-8-0x0000000000401000-0x0000000000415000-memory.dmp

Filesize
80KB

Download