7d9bb210d59a34eeec5bd08e832c1c00e80be5ec7bfb8555c88a53bf1b400181

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 10:13

Target

29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe
Size

737KB
MD5

29e99298bee7ef09ccfc18763baf0b27
SHA1

fa2c2febd6d98f512ef5d2d54358a2ccdc88c336
SHA256

7d9bb210d59a34eeec5bd08e832c1c00e80be5ec7bfb8555c88a53bf1b400181
SHA512

95abdfe7004dd06871dc6805ad1cd7d10f2724aead670db7b430211f49080700df55bfbb8dba82c04a19165499e55b93c703a2b8a9e45faecc4e05dc7c119a87
SSDEEP

12288:RGIHu4ixWwhJjuOXBUsTTW1W8568YRpRlaXFqTnPfsufomPNLkaMoWeT7vvmwPk1:RJu4iRrdTyj5ypRsaPkuAmlkFC8q16D

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3700 set thread context of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe
3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82
PID 3700 wrote to memory of 4744	3700	29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\29e99298bee7ef09ccfc18763baf0b27_JaffaCakes118.exe
  2⤵
  PID:4744

memory/4744-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4744-1-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4744-2-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4744-3-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4744-4-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download