6d3ddf94a2cb6d83a9a9a1f4571c16e84d8b4d05a23e6b02dde241837a6ad70a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 23:11

Target

47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe
Size

7KB
MD5

47306e878e30151e1f8a96df37a7ba28
SHA1

b99a49df834c6b056fb5bf056261138b8d1e9afa
SHA256

6d3ddf94a2cb6d83a9a9a1f4571c16e84d8b4d05a23e6b02dde241837a6ad70a
SHA512

05fd0d68c308b79ba764e37ff29917a113b6c4dbd14846657544cefd0943b1113f32168d3626c31a319f6e8effb677e630ce47183b20b5e7edb6c27d073949bd
SSDEEP

192:1aBRiv1nenB5Ye+TlU80npV3wOs/9tcs/z257LLUFjmmfQFphgs+:AGtege+Tlj0nAOQtcs/z29U5mf+

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4132	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4120 set thread context of 4132	4120	47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe	89

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4132	4120	47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe	89
PID 4120 wrote to memory of 4132	4120	47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe	89
PID 4120 wrote to memory of 4132	4120	47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe	89
PID 4120 wrote to memory of 4132	4120	47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47306e878e30151e1f8a96df37a7ba28_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:4132