9f73db94e648eea45f8fdd0e0e03fc3fcb6a801aeda2219e0926136b903c1245

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 16:09

Target

39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe
Size

270KB
MD5

39d51e46199e5f1d7111dc4ac4baeb79
SHA1

0b616320043d8f40965c0ad3e5942c2afefbab7e
SHA256

9f73db94e648eea45f8fdd0e0e03fc3fcb6a801aeda2219e0926136b903c1245
SHA512

c8fbd73a144492ae382e9fd9079805361515c4ca5960bba82f0f4320875f175b7ed9fc6373077dbe73c9998bff58ff254e535c16a1abdaed54a4209d37f9ced7
SSDEEP

6144:xsGlXoO+KA2NxDENSTqXatI7ty59X4svX+nizQhJq:yGlXop2NxAqjI7t+XoiCJq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe
4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe
4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe
4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84
PID 2512 wrote to memory of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84
PID 2512 wrote to memory of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84
PID 2512 wrote to memory of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84
PID 2512 wrote to memory of 4368	2512	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	84
PID 4368 wrote to memory of 3468	4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	55
PID 4368 wrote to memory of 3468	4368	39d51e46199e5f1d7111dc4ac4baeb79_JaffaCakes118.exe	55

memory/2512-2-0x0000000050000000-0x0000000050049000-memory.dmp

Filesize
292KB

Download
memory/3468-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3468-7-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4368-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4368-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4368-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4368-5-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4368-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download