ce94e787d9647d57784ac695338a0999c005f6cb21fa57be0c624b214c4f47ba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 15:48

Target

28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe
Size

443KB
MD5

28b667c0f4b8aaf26848b777172ed407
SHA1

509a8c56c598e2f74b53591a3d1e1d6a6cc69c6e
SHA256

ce94e787d9647d57784ac695338a0999c005f6cb21fa57be0c624b214c4f47ba
SHA512

3de3fa4a045195ba110dc23fb1f0346d44110773094152610582115ef2ab73b9c5959fba26d19de18eb9ed86aca14589c6bca5e68695c46778aa19f53ca2fb90
SSDEEP

12288:DDNkFa5fF7RTX979xwJyTW7DsVpCmOtAjWh7It:DJ+gF1tTyyTW7CpIjhM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2980	2772	28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\28b667c0f4b8aaf26848b777172ed407_JaffaCakes118.exe
  2⤵
  PID:2980

memory/2772-6-0x0000000020000000-0x000000002005F000-memory.dmp

Filesize
380KB

Download
memory/2772-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2980-5-0x0000000000010000-0x0000000000030000-memory.dmp

Filesize
128KB

Download
memory/2980-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x0000000000010000-0x0000000000030000-memory.dmp

Filesize
128KB

Download