d97844f62223f75061719f2d5cb344e49397eda8f1f29a9c2d3d05084fec38fd

Analysis

max time kernel
11s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 08:32

Target

2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe
Size

51KB
MD5

2ba9a2ad0545e7e37baf949f53c8d6d2
SHA1

203b8155ce200fcbabf0df470caa022429acbcf4
SHA256

d97844f62223f75061719f2d5cb344e49397eda8f1f29a9c2d3d05084fec38fd
SHA512

abf59ecd717baecdb34b86487c1df639f492de20ed12980f11e6a27418974e0cfc6cc5c8ef74bbfd2cede4be2363591a1bfae931815dd907b18741509a050aef
SSDEEP

1536:JocHhoagfKgIO7XJHPK9muF+4yQX3Bhzs4JQ:fBiygx7ZC7F+4bv/Q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2556	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29
PID 2584 wrote to memory of 2556	2584	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2556

memory/2556-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2556-0-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2556-4-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2556-8-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2556-6-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2556-2-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/2584-12-0x0000000000060000-0x0000000000074000-memory.dmp

Filesize
80KB

Download