e091ae9ac7ebd25b58b5f6dab08e16a4561a32b8eb03359e103084a75b859425

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 14:24

Target

2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
Size

83KB
MD5

2cb094928ed3520f39140e53b6e5c314
SHA1

8ac4402b821e0767b2933ffa5954c068e595ee30
SHA256

e091ae9ac7ebd25b58b5f6dab08e16a4561a32b8eb03359e103084a75b859425
SHA512

92b7aa93802b3bcbaf7b5e64962853ee5f877abcfa5fb0b5222cee74e929a1c6d13aa29f1d4508c9c537dfa0b5865b08f92aa6094642014929d807f80dc51e00
SSDEEP

1536:4YuHgH/+8YcM7zqt+MYvBUGbt4JtDRLCyB6E06LigZ5zofcAq/bVw0IwP:nHZrsut+DBLt43RA6VTjDNI8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30
PID 1188 wrote to memory of 2684	1188	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe"
  2⤵
  PID:2684

memory/1188-10-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/2684-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download