9e25dc0000c00ed10d1840974d3d14edab95f0237951e01dcc19ab36d78a1973

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:27

Target

49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
Size

200KB
MD5

49632a66ed0faba5d59d93bf87fd165a
SHA1

cda48ac273a4c98a0921aeba3fa9cb6379a060be
SHA256

9e25dc0000c00ed10d1840974d3d14edab95f0237951e01dcc19ab36d78a1973
SHA512

7c043c7f17d7409f581b45e1641ed9b818df1ef3995a6818a06a52c7a463cf6b1d7bee16a209ca9dbe4176f2788f3c5ca3cd8b8895f64e7666f9d93cb909f59d
SSDEEP

3072:mvgsP0p4wwlt1OWp5aXJy8TdfgyvR1KsfQmUzX0UG8ulfZ5nUiTrb:mIi0p4FTo/dp/KsfQNEZtZF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2908	2120	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe"
  2⤵
  PID:2908

memory/2120-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2908-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download