2140bc2c3e639f20ed5aa67fe75991a90ab240c9645135b1f969f47a02d1ecb4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:23

Target

3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe
Size

322KB
MD5

3b4d979ea2ee1d483db430beb97c6e40
SHA1

72fd170f0031fdefcf2146649575683686551cb5
SHA256

2140bc2c3e639f20ed5aa67fe75991a90ab240c9645135b1f969f47a02d1ecb4
SHA512

d612706fefb5bdde40880765d1baa1c6d82bad7b8a3961e39c558f50f4962aaf8f9528cab0bad57ac79927a8578277c698dc51d366baebcba7fb6630ecf2f273
SSDEEP

6144:4O/LUn6njXUcPVmZZgdAmSrCprb/4ZIwMrz9Z06YU03b3ZMTC:xjXFmQdAmcCJ4Z9sTgMW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86
PID 4660 wrote to memory of 2304	4660	3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3b4d979ea2ee1d483db430beb97c6e40_JaffaCakes118.exe"
  2⤵
  PID:2304

memory/2304-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2304-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2304-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2304-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4660-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4660-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download