13c1d7a0ec1b8df847087808f651d45391d98ec7da49e7b3d1d73dad025e6a1f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 05:18

Target

3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe
Size

52KB
MD5

3370d6f3674a8a3e3c67c5373f6a88b1
SHA1

223dbacc4d5b6bb1cc81a692af328ab4bf74f667
SHA256

13c1d7a0ec1b8df847087808f651d45391d98ec7da49e7b3d1d73dad025e6a1f
SHA512

34ef2314bd8d3a886ad9052ed8eda1cd2ba33215da54d3e69ab6ce9ce5f2558af14e4d1fc22e9f167200adcb03d1f53817a05fcfb646d4abbe393daf7637c485
SSDEEP

1536:/CmqWgjwEopCLKbw+crodny4uAbY+9fyvC9f:VrEoALz+Godyv+q8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80
PID 3388 wrote to memory of 4756	3388	3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3370d6f3674a8a3e3c67c5373f6a88b1_JaffaCakes118.exe"
  2⤵
  PID:4756

memory/3388-5-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4756-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4756-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4756-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4756-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download