d6af7a54f39ac85101ac1ba39cbbe9f1beb25dbb19d253d935721d0706be7ed2

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 16:59

Target

6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe
Size

42KB
MD5

6403f817dc806b91cd51010395f5a2dc
SHA1

b64432668c054b823a0bc94d4ace4db9fae0c1ef
SHA256

d6af7a54f39ac85101ac1ba39cbbe9f1beb25dbb19d253d935721d0706be7ed2
SHA512

e416c8bba3308657e9035033edb6891c8aa77159fc4cff6372548d7be10776e36d38ad22b1a93c45584afb7e0345fc92faaa609ed83ae84aab1880d394093fd6
SSDEEP

768:Hs588ypamyHHtI8j3wsBdmSlKGQfvymKIjJukK5vez6CNjqEP4:H84pas+BdmqhQfKmKlkKVeWCN1g

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30
PID 1488 wrote to memory of 2140	1488	6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\6403f817dc806b91cd51010395f5a2dc_JaffaCakes118.exe
  2⤵
  PID:2140

memory/1488-1-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download
memory/1488-13-0x0000000010000000-0x000000001001086C-memory.dmp

Filesize
66KB

Download
memory/1488-0-0x0000000010000000-0x000000001001086C-memory.dmp

Filesize
66KB

Download
memory/2140-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2140-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2140-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2140-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2140-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download