fea869278415e23f69ead17c982bce69e9e9f5dcdb2d49278029f5d1d13f4b05

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:08

Target

4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe
Size

450KB
MD5

4a9c9924515fe12662e45c2eba3ac935
SHA1

c642c3a6a84ff919a348867322c4e4f279451146
SHA256

fea869278415e23f69ead17c982bce69e9e9f5dcdb2d49278029f5d1d13f4b05
SHA512

9fa0bb3953ae00b941d379c635a560e665b32ee54e5e0d729209a5afb70df533ada3295ef93bc3441c7f9d4415573e138c318f9b5164147c8586ed4d6e9b9fea
SSDEEP

6144:KGc7pvmEv5CH2o294kzW0c+j+jfXb6t57rRnJO1yWZaGQ2ruaj7haszGzrshj:49XEHZ22mrNWfL6waG97hafzY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30
PID 2968 wrote to memory of 3008	2968	4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4a9c9924515fe12662e45c2eba3ac935_JaffaCakes118.exe
  2⤵
  PID:3008

memory/2968-35-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/3008-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-31-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-36-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3008-28-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-4-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-10-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-22-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-25-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-19-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-13-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3008-37-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download