98aeab60865273ddcbbb2530be20d49cc5fd223dd2e5826b32f0028d48d7dae3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 19:17

Target

2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe
Size

1.4MB
MD5

2d847cf3fcf801b293a5a60039ed453a
SHA1

4f59f5c7cdc95a7eb3b0f046ac5736bf5f73efbd
SHA256

98aeab60865273ddcbbb2530be20d49cc5fd223dd2e5826b32f0028d48d7dae3
SHA512

835dab9d546c5bf2476c1815115f4ec157c41292c9ba840bb317f16db2a77dc28d9dd87f15f9be9b54f0d476c22c1c7ad17edd1b49f685661ba7fe97b4411d69
SSDEEP

24576:qk+++hBIRgRZnk4Y1KWmQo7JsL4YSjR3Rk1tWmIJTFTl0RXpzrq+AbDeukcNmca4:Yhz99u4YI3S12JBl0XzVxc8c3H

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2344	1488	2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d847cf3fcf801b293a5a60039ed453a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe
  2⤵
  PID:2344

memory/1488-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1488-4-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2344-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download