9d241adc5202fb94ef9e5f4a305a75a8341dd0e491a4162502dd7884abd3c447

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:12

Target

5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe
Size

68KB
MD5

5be423c25fa3e6a6022de20f282ff7cb
SHA1

b9d80693cb562ae2d14506d1c873505a2314eac7
SHA256

9d241adc5202fb94ef9e5f4a305a75a8341dd0e491a4162502dd7884abd3c447
SHA512

8bc15e70cb21d2721e26efd5dc66f1981f3651140e22a0900e85b1e63244ed91ec2c8c09cde2a1ef491a205ade15f84335c0aa641b45d07a61e0f66bc61d4adc
SSDEEP

1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWoE:r1BvK7pmCzSlNILr7mrlE

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86
PID 696 wrote to memory of 2304	696	5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5be423c25fa3e6a6022de20f282ff7cb_JaffaCakes118.exe"
  2⤵
  PID:2304

memory/2304-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2304-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2304-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download