166138ab78a159c88c7d4fb2cebc421acb11737ff5797b3047cab3df9d028afe

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 07:27

Target
5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe
Size 54KB
Sample240719-h924casdqa
SHA256 166138ab78a159c88c7d4fb2cebc421acb11737ff5797b3047cab3df9d028afe
MD5 5af8c07fbf8036bf9a20fbc25c2abfd6
SHA1 1e6bd96c005425029199965208a613814a72b282
SHA512 f3bb0122088157ccf1db7ea686602d5b8f828947de73651a9ad1017d694442d2bdc95f8f6f5e56daac64544db1e4feaa182c784f6ab53fd3e17653557efcf2ce
SSDEEP 1536:3MZSyoIQEXwfQ1WmfCew8Sarho1lidUJH/:8hrQ4mQ15vWiY
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe
2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe
2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe
2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84
PID 5008 wrote to memory of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84
PID 5008 wrote to memory of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84
PID 5008 wrote to memory of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84
PID 5008 wrote to memory of 2324	5008	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	84
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56
PID 2324 wrote to memory of 3444	2324	5af8c07fbf8036bf9a20fbc25c2abfd6_JaffaCakes118.exe	56

memory/2324-1-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2324-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3444-2-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Download

memory/3444-4-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Download