773f82f5914b0842adc8354ea96ec68c60ce0692916442138a14c6191690efcc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 20:05

Target

26178d9eac0999238526e993ffb39520_JaffaCakes118.exe
Size

32KB
MD5

26178d9eac0999238526e993ffb39520
SHA1

f6cb2e821955b5d0c71a68844a0a266af916e37a
SHA256

773f82f5914b0842adc8354ea96ec68c60ce0692916442138a14c6191690efcc
SHA512

0d35e2fd44e541ac76f0afce34f55b993872bbe849db3d1777eb4b83220ef9bd1aa84f9997d4f245b383f66a2847cf5d4579502621d8ef95b0d78743974d532d
SSDEEP

768:1JSUqh5sFgdUKm1Dq1Vdje07Bl5tJkSV2ICP:1/Zg31VcSsIQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2992	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28
PID 1420 wrote to memory of 2992	1420	26178d9eac0999238526e993ffb39520_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\26178d9eac0999238526e993ffb39520_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26178d9eac0999238526e993ffb39520_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\26178d9eac0999238526e993ffb39520_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\26178d9eac0999238526e993ffb39520_JaffaCakes118.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2992

memory/1420-8-0x0000000000010000-0x000000000001F000-memory.dmp

Filesize
60KB

Download
memory/2992-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2992-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2992-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download