0c3fef16327d3141befff8854c59cb2b1dc21c230c3ee8aa0e39355d883db963

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:25

Target

1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe
Size

70KB
MD5

1c8d30e163f6f6722366ed2d295fb1bf
SHA1

c553274897034205cac97d2f9f98e80b29caafae
SHA256

0c3fef16327d3141befff8854c59cb2b1dc21c230c3ee8aa0e39355d883db963
SHA512

f7f3ee15eb78f060f33aed826e4822d2e56bf85c1a8cf5a4015d1576c3c76e3a7461af374aed194389339b94a3f3ee7f18c20b9f27cdac6d5d0ce7b4c6b31c97
SSDEEP

768:vEEYCl0ax2rCDhEhlFm3bIic7VjJerWgz/htJH2oIaTZhJnwTMrpfItAVX6oIyDi:Dx0OOh+bKVj4Cgz/DJHdTNRpJ66tSlB1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe
5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe
5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe
5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85
PID 3988 wrote to memory of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85
PID 3988 wrote to memory of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85
PID 3988 wrote to memory of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85
PID 3988 wrote to memory of 5092	3988	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	85
PID 5092 wrote to memory of 3396	5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	56
PID 5092 wrote to memory of 3396	5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	56
PID 5092 wrote to memory of 3396	5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	56
PID 5092 wrote to memory of 3396	5092	1c8d30e163f6f6722366ed2d295fb1bf_JaffaCakes118.exe	56

memory/3396-5-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3396-6-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3988-0-0x0000000000400000-0x0000000000411800-memory.dmp

Filesize
70KB

Download
memory/3988-1-0x0000000000400000-0x0000000000411800-memory.dmp

Filesize
70KB

Download
memory/5092-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5092-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5092-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5092-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download