f50aac613ee94e4eba6ef7db67ede27e7f1ea7f0ee3e6e53cdec2b287dc314d4

Analysis

max time kernel
15s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 12:33

Target

45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe
Size

67KB
MD5

45d4621ef345608d6dffca5747cb9074
SHA1

21d8f9ae8ca1be4c7d65ae9cd65c3f2ff1b6da90
SHA256

f50aac613ee94e4eba6ef7db67ede27e7f1ea7f0ee3e6e53cdec2b287dc314d4
SHA512

002c5bfbb964bad054872b4391be3446c04f8b88655234fd249766132de748600d748bfd9831373e721e375ae46d6025b672d9a6c37dc2fffd37b16201c64e50
SSDEEP

1536:Lh3L/g6QbPoKOiJ6o7v72jcpuEb/HeHZ+:LBWbPoKOFA/w+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\45d4621ef345608d6dffca5747cb9074_JaffaCakes118.exe" "
  2⤵
  PID:1612

memory/1612-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1612-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download