9153cdcd038c002c52a99e259bf2c399e6d925581b9282f4e6857c899dd65d57

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 14:05

Target

5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
Size

476KB
MD5

5c4204f89c55359595a5c707f6fa22f1
SHA1

48e5e3e34a02fcdfb229c87a5c1f4362a833f5ce
SHA256

9153cdcd038c002c52a99e259bf2c399e6d925581b9282f4e6857c899dd65d57
SHA512

a99ccb3784320968273e9db13f8483e3696f28f514d55964d1775949154fed596cd575a596d6d52094d7cc567ae3c6ded385c19b6c9256ff4cd5f333aa706aad
SSDEEP

12288:wLFtpZNmMLVcHvvm/EPr4RXLGtwd4O7C5hA0MtnPZo:wxtfNmMLVcHvvm/EPr4RXLGtwd4O7C5b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1160	2136	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe"
  2⤵
  PID:1160

memory/1160-10-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-8-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1160-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download