633ec4e073d397464c3dfd904d29f52f6f6908b6a2136952ff5a27a9e8e6a53c

Analysis

max time kernel
139s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 08:24

Target

21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe
Size

156KB
MD5

21b07a3b6ac3e8f81c61d6dcac3722b0
SHA1

84ae0beb30ba6e6e8fa4d814eefc7b00a78d3ac7
SHA256

633ec4e073d397464c3dfd904d29f52f6f6908b6a2136952ff5a27a9e8e6a53c
SHA512

fb6eb555ee9618b511e5b5cca4866706756c7c60b380745f356f7f34276edb178db2d841a4e25e49d9d1c3f9f0b8d52a4e034d22130ec85d5a083eddd1d19d3a
SSDEEP

3072:7tknUbXsgCrgYKgK7v8yTYP9cC4tR9nQ1OrQWAuoT5tr1D3OGc9TRV:RbXBMOg+v8yXZWkqF1jHcrV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe
3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3476	1288	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	83
PID 3476 wrote to memory of 3528	3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	56
PID 3476 wrote to memory of 3528	3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	56
PID 3476 wrote to memory of 3528	3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	56
PID 3476 wrote to memory of 3528	3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	56
PID 3476 wrote to memory of 3528	3476	21b07a3b6ac3e8f81c61d6dcac3722b0_JaffaCakes118.exe	56

memory/1288-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1288-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3476-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3476-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3476-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3476-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download