b73bf156e3eed7a477283aa37ce2f049ba91e89cdf76910c7f9965da9ba05940

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:38

Target

4872414308389221a7b364684a5c5d71_JaffaCakes118.exe
Size

187KB
MD5

4872414308389221a7b364684a5c5d71
SHA1

e9f83fc26b5aa438b277281350dd907fb0e9e856
SHA256

b73bf156e3eed7a477283aa37ce2f049ba91e89cdf76910c7f9965da9ba05940
SHA512

52e09269861cf92f47239af29355a03eb599f112583ad12c4c8d88498aba4a6d50b222b64e83fff5618a06a3fa896f4a9fb70d9f4b66a0b5124b0cd9e0ded10f
SSDEEP

3072:L6hWTcH2UnlasW7Y2MB8X6YxXT3igWG05kdJjnTvxkWF:8WTcWUnl7WQ+fT3ikVzJ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30
PID 1952 wrote to memory of 2900	1952	4872414308389221a7b364684a5c5d71_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4872414308389221a7b364684a5c5d71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4872414308389221a7b364684a5c5d71_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\4872414308389221a7b364684a5c5d71_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4872414308389221a7b364684a5c5d71_JaffaCakes118.exe"
  2⤵
  PID:2900

memory/1952-4-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2900-3-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2900-2-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2900-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download