9e25dc0000c00ed10d1840974d3d14edab95f0237951e01dcc19ab36d78a1973

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 10:27

Target

49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
Size

200KB
MD5

49632a66ed0faba5d59d93bf87fd165a
SHA1

cda48ac273a4c98a0921aeba3fa9cb6379a060be
SHA256

9e25dc0000c00ed10d1840974d3d14edab95f0237951e01dcc19ab36d78a1973
SHA512

7c043c7f17d7409f581b45e1641ed9b818df1ef3995a6818a06a52c7a463cf6b1d7bee16a209ca9dbe4176f2788f3c5ca3cd8b8895f64e7666f9d93cb909f59d
SSDEEP

3072:mvgsP0p4wwlt1OWp5aXJy8TdfgyvR1KsfQmUzX0UG8ulfZ5nUiTrb:mIi0p4FTo/dp/KsfQNEZtZF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3864 set thread context of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83
PID 3864 wrote to memory of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83
PID 3864 wrote to memory of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83
PID 3864 wrote to memory of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83
PID 3864 wrote to memory of 3568	3864	49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\49632a66ed0faba5d59d93bf87fd165a_JaffaCakes118.exe"
  2⤵
  PID:3568

memory/3568-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3864-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3864-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download