adca7d97a41a06dc64c5c52dc17c426cbef5831b71ed2224a3305ec29fbc38b7

Analysis

max time kernel
117s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 19:40

Target

2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe
Size

322KB
MD5

2386b3e0f5838ed703f47609640f0b88
SHA1

ddf357c937df06db04a9ff305fa193de7a4583dd
SHA256

adca7d97a41a06dc64c5c52dc17c426cbef5831b71ed2224a3305ec29fbc38b7
SHA512

d33f4b316a51bce0b3c0bf38e94080f98ea95d66928084f48b98bbf7578fe032f15902ee82e611afb0b1df632182bd99eced147e703e0424a99eb72a204da1b9
SSDEEP

6144:BJiCtKk4IwCpkoD1ijqNZKRCWMq+OodNkmCihmve:XwzGpkw1ijCZKRCWMq+NPRJMG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85
PID 5116 wrote to memory of 2132	5116	2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2386b3e0f5838ed703f47609640f0b88_JaffaCakes118.exe"
  2⤵
  PID:2132

memory/2132-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2132-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2132-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5116-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5116-6-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download