2d5b1d667cd26903ca1c9a6c78a1d4385f5fe612dbd312a48ef60e2677bf36e1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 12:06

Target

632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe
Size

170KB
MD5

632a3af82bd9d8e6f6f4d7e47fc24d7d
SHA1

13064a5418bb9b2f61abbdb1764bf5596c5a0506
SHA256

2d5b1d667cd26903ca1c9a6c78a1d4385f5fe612dbd312a48ef60e2677bf36e1
SHA512

6db82877a57d7088e4c313018e7cbef272b21b5aa2ed432bad386b4b136cf49ec05c1eecec1cccffeec352a54ed67a23d53aaa86ddd7f6a6a8674ac32ac2cad4
SSDEEP

3072:FJ166V+lZSuk+s5MX3YHi0e0LfwS6KgFn8hCmo/RgMq+TtG3DYeBdA:FJN+Hk9woHiAfngtKWttGzY2dA

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30
PID 1956 wrote to memory of 2092	1956	632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\632a3af82bd9d8e6f6f4d7e47fc24d7d_JaffaCakes118.exe"
  2⤵
  PID:2092

memory/1956-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1956-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2092-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2092-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2092-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download