756b67abc8b7aa9703757b8c64abbb2e60f32020016a48ade071c8c5ea6dc5f6

Analysis

max time kernel
54s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 01:13

Target

29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe
Size

127KB
MD5

29a2e79407ce167058c8f594942bcd45
SHA1

67c7cfe5ca131eb196da1216f719acdc769d8611
SHA256

756b67abc8b7aa9703757b8c64abbb2e60f32020016a48ade071c8c5ea6dc5f6
SHA512

c123eb995468d0470a14c2c2b841ed7c595209f2d66abeab64d9c746cdadada13e234927b2e8aa2087b366bf0e6b5c802dfa640aa31f110219831dd57003d10e
SSDEEP

768:J9xjAZ5T6H3deXsDGnfyHE5AE+cCltnPSBcsIaDToe/wL+x50dnIO9FJwIbBZH/K:vxjAZ0VOqYolU0dn7JwIlZ5mvLa

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3512	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4276 set thread context of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3512	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe
3512	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 4276 wrote to memory of 3512	4276	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	81
PID 3512 wrote to memory of 2792	3512	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	82
PID 3512 wrote to memory of 2792	3512	29a2e79407ce167058c8f594942bcd45_JaffaCakes118.exe	82

memory/2792-10-0x00007FF660A80000-0x00007FF660F1D000-memory.dmp

Filesize
4.6MB

Download
memory/3512-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3512-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3512-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3512-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3512-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4276-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4276-3-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download