1211e82478bc7ec19385af35c6d380dce32972a8410e77f8abe76934335885be

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:13

Target

32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe
Size

88KB
MD5

32ed73df106a4dd9ec006ce5f341b1cb
SHA1

c17f7bf9f633cfeea4f4de804a78346f03173d2d
SHA256

1211e82478bc7ec19385af35c6d380dce32972a8410e77f8abe76934335885be
SHA512

dcef689ca66916fc843ad6ae1f986a22d6d0edbddbf49884f7a615a5e8fb91aabb9ca3c4901bd0d3a790520ec211b17c42bb80ae88f35aad9525bc08cc37403f
SSDEEP

1536:AzH+lUFl01sLz35oXXpPmBwgPHa5Dt+1Wonb03U9uNw:AzHWUFK143SXW9PHS+A8Qo

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\too7jdyy.exe	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\too7jdyy.exe	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2164	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2164	2412	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	30
PID 2164 wrote to memory of 1216	2164	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	21
PID 2164 wrote to memory of 1216	2164	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	21
PID 2164 wrote to memory of 1216	2164	32ed73df106a4dd9ec006ce5f341b1cb_JaffaCakes118.exe	21

memory/1216-15-0x00000000025B0000-0x00000000025B2000-memory.dmp

Filesize
8KB

Download
memory/1216-13-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1216-14-0x00000000025A0000-0x00000000025A3000-memory.dmp

Filesize
12KB

Download
memory/2164-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2164-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2164-16-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2412-3-0x000000000040B000-0x000000000040C000-memory.dmp

Filesize
4KB

Download
memory/2412-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2412-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2412-7-0x00000000005B0000-0x00000000005CF000-memory.dmp

Filesize
124KB

Download
memory/2412-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2412-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2412-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download