709a60ec5544d735e1879a62d1b72c3f5ecd7c435793d383c362cff6c81071e2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 05:59

Target

44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe
Size

273KB
MD5

44995a7c821dc4941f7b02b950cb6473
SHA1

cd885b80fd3fc90c4aae8c8cb06a5a5d91845313
SHA256

709a60ec5544d735e1879a62d1b72c3f5ecd7c435793d383c362cff6c81071e2
SHA512

446c108da6eb21ae34d8b462d2ca43445766ea2b2f04fbec06778fdc58a3e275f9013cbc40ae94b27f3ae29145221627d11b5b4f322f226f42ce304071aa34de
SSDEEP

6144:5eecXk7XWw+Bof5rgwCYqO47Go201EPByuEXWq/bAwE8CN4mV0cQ91Z7:NYSXWwAe5rgwCY54KGWPPm/bAz8C2vPT

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2132	1900	44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\44995a7c821dc4941f7b02b950cb6473_JaffaCakes118.exe
  2⤵
  PID:2132

memory/1900-6-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2132-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download