59edd9c9fdac9ae1905a19a5cb0a64c5243af0d22c2a2983ce7113a0dd2ecdf9

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 10:17

Target

5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe
Size

68KB
MD5

5b837f71a775fc14248e8404be9d4689
SHA1

27720e534c0eb8b93dc30af6ef433a4d121555c5
SHA256

59edd9c9fdac9ae1905a19a5cb0a64c5243af0d22c2a2983ce7113a0dd2ecdf9
SHA512

81497aa2d5dbd0c8c175211841ad79895b867015e1007c687cf13b8836c9134057fe72cea9f6522c953340dfd82fd92d3765b4cdda22847a49bd0134724a2d4f
SSDEEP

1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWox:r1BvK7pmCzSlNILr7mrlx

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84
PID 3408 wrote to memory of 2916	3408	5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5b837f71a775fc14248e8404be9d4689_JaffaCakes118.exe"
  2⤵
  PID:2916

memory/2916-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download