c14d554ed3964c7d1b0e4f955bab0f160b3c743dccb858e3e01e0775293e7655

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:21

Target

5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe
Size

88KB
MD5

5bec465da7cfcddc593685912f93cae8
SHA1

6c7701d20ccc8c74cdad29328829167dc04701f3
SHA256

c14d554ed3964c7d1b0e4f955bab0f160b3c743dccb858e3e01e0775293e7655
SHA512

499a174f7256a404f9f3a7f781c341f57e4ef4ebe5d2f92b92e9237587f93cfd7c17ca6f251b0f58a4c24e20dd6e5c09daceb087ff91b5301f804535666f2d3a
SSDEEP

1536:0OUyCCdVuUB24Ngwy6SogaaQg2oz+xh7z5k7WQ6C1f/I:H3CCuS24NfyogaaQdozchP57C1f/I

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ytjj1ttoojy.exe	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ytjj1ttoojy.exe	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 1100	2148	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	30
PID 1100 wrote to memory of 1236	1100	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	21
PID 1100 wrote to memory of 1236	1100	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	21
PID 1100 wrote to memory of 1236	1100	5bec465da7cfcddc593685912f93cae8_JaffaCakes118.exe	21

memory/1100-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1100-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1100-14-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1236-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1236-12-0x0000000002550000-0x0000000002552000-memory.dmp

Filesize
8KB

Download
memory/1236-11-0x0000000002540000-0x0000000002543000-memory.dmp

Filesize
12KB

Download
memory/2148-0-0x000000000040B000-0x000000000040C000-memory.dmp

Filesize
4KB

Download
memory/2148-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2148-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2148-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2148-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download