3be9c19949182673f3e59a608696a9724b607a910b7ae2d7b852722d1620eefb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 07:32

Target

624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe
Size

72KB
MD5

624dd2fc64071c64be4ea86bd1537e93
SHA1

2ebef09c2095fcbdb386e9ad11449ee810139e72
SHA256

3be9c19949182673f3e59a608696a9724b607a910b7ae2d7b852722d1620eefb
SHA512

e83e7794fde6bb44f320d4d3d98ebb780b3a366fd21d97f84ecfee23604b224beb69ba3fbe0fec5ec99e8c5522d0266b5401d34ecc6ad3222d3e4bd28b6cdade
SSDEEP

1536:f4DAu+UMeP+Rdg2ytaBOcKLjoz1i9V/zShEt6ug7rFn:SIflWErijEhEt6X7rd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe
1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1832	3012	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	30
PID 1832 wrote to memory of 1200	1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	21
PID 1832 wrote to memory of 1200	1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	21
PID 1832 wrote to memory of 1200	1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	21
PID 1832 wrote to memory of 1200	1832	624dd2fc64071c64be4ea86bd1537e93_JaffaCakes118.exe	21

memory/1200-29-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1832-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1832-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1832-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1832-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1832-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download