9153cdcd038c002c52a99e259bf2c399e6d925581b9282f4e6857c899dd65d57

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:05

Target

5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
Size

476KB
MD5

5c4204f89c55359595a5c707f6fa22f1
SHA1

48e5e3e34a02fcdfb229c87a5c1f4362a833f5ce
SHA256

9153cdcd038c002c52a99e259bf2c399e6d925581b9282f4e6857c899dd65d57
SHA512

a99ccb3784320968273e9db13f8483e3696f28f514d55964d1775949154fed596cd575a596d6d52094d7cc567ae3c6ded385c19b6c9256ff4cd5f333aa706aad
SSDEEP

12288:wLFtpZNmMLVcHvvm/EPr4RXLGtwd4O7C5hA0MtnPZo:wxtfNmMLVcHvvm/EPr4RXLGtwd4O7C5b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84
PID 4980 wrote to memory of 8	4980	5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5c4204f89c55359595a5c707f6fa22f1_JaffaCakes118.exe"
  2⤵
  PID:8

memory/8-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/8-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/8-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download