cb4aa07f83e36aaac8270659606a1585f890b0e450842231cbb62fcbb7a41f1a

Analysis

max time kernel
140s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:58

Target

39995c03260fe8f31763600994d55401_JaffaCakes118.exe
Size

35KB
MD5

39995c03260fe8f31763600994d55401
SHA1

1e2a3f9b29c014ebefaed7c1bd163da9d9de23e0
SHA256

cb4aa07f83e36aaac8270659606a1585f890b0e450842231cbb62fcbb7a41f1a
SHA512

d4cf74a7205d5e28500aa5ae293d078b8bdeef0cc066fbc126347d7ed3dcfff124870e9aa5946987a6d038b9183bd4e6ededbdeb9b276985b025539678673388
SSDEEP

768:00YBEglpqqht8y7kHYJs1qbo9kXCJ2SqPpNEjW2gq:Od5htVQ4U+o9XNq4W2gq

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3272 set thread context of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	39995c03260fe8f31763600994d55401_JaffaCakes118.exe
1952	39995c03260fe8f31763600994d55401_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84
PID 3272 wrote to memory of 1952	3272	39995c03260fe8f31763600994d55401_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\39995c03260fe8f31763600994d55401_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39995c03260fe8f31763600994d55401_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\39995c03260fe8f31763600994d55401_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\39995c03260fe8f31763600994d55401_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

memory/1952-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1952-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download