818d9e5b9331a66770abc369cd3db42432e09a347f6e068e1f4cb938c5ec7da0

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 00:28

Target

656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe
Size

35KB
MD5

656bdd06ffcf4f361dd4614336a2f543
SHA1

e833441e9fe13df11626a7da92943f87efe3bdf6
SHA256

818d9e5b9331a66770abc369cd3db42432e09a347f6e068e1f4cb938c5ec7da0
SHA512

2622c2b887f8fc957d8a0e96682eb62a0e9709fe38ae8c655f5a85e57fcda1d183d185036944d4b195494a2040c3b328026c23a0b222755dc3a2850117c7f85a
SSDEEP

768:bJDI8yje1xw7KwzNlTV6kU/Y8u5/LdDQ:bJDk2kl4V/G5pU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2792	2820	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe"
  2⤵
  PID:2792

memory/2792-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2792-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-14-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download