1e8c33e32beb2704891f82e9b3a40c69d91ae513cef78eb53f6c862cc37d2160

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 06:21

Target

3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe
Size

292KB
MD5

3c4947917f5fbba01e7fd70bc7c959dc
SHA1

c464b9289d072f6d283c4f1c33858c3262936ed6
SHA256

1e8c33e32beb2704891f82e9b3a40c69d91ae513cef78eb53f6c862cc37d2160
SHA512

61d9e588d0fa8f17eeac4864b3cdddbb4bad62648be7ed0af470c1905012dcd4da8cbb3e5f1618fcba7e2c91246296006ef93f64fe265531eb1bb659fdd0799a
SSDEEP

3072:CqBYp175d+mPMVjh/hoIDL1Ng5Icm6sPIOLVwKoujk1uHP/lWqvEGSF3+CvSFyAb:RBa17iVvwZDsig7HSgyAGI1a2TKs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83
PID 3240 wrote to memory of 4024	3240	3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c4947917f5fbba01e7fd70bc7c959dc_JaffaCakes118.exe"
  2⤵
  PID:4024

memory/4024-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4024-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4024-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4024-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download