c535f32c57aa73bb570c8688f86d737756526683ed9f71910153281fdde2df30

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 05:14

Target
29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe
Size 270KB
Sample240707-fxa3zsvbml
SHA256 c535f32c57aa73bb570c8688f86d737756526683ed9f71910153281fdde2df30
MD5 29c107328358ccbda902f4199dc5b972
SHA1 57951515149b3e9cd56f98e0af366dfd647d2b58
SHA512 e0f45f2cce58d5daed072c83b734ee409a38fa1bafea6301a6a8e50400799364d17bccf0e89516014a9610815477240d79b2c7164146573d554d0e5b8c5498cc
SSDEEP 6144:DmMzaDPIdvhYX6jhipVco0nl5fkw8DQfKJ6wbIkAV0i:DNzaDPIdZXjkpyo00rImi
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85
PID 1528 wrote to memory of 1504	1528	29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\29c107328358ccbda902f4199dc5b972_JaffaCakes118.exe
  2⤵
  PID:1504

memory/1504-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1504-3-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1504-4-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1504-5-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1528-2-0x0000000000400000-0x0000000000449000-memory.dmp

Download