5c7b6abe1451f7b3e701f4517a9551d40e569931944f90295bb8ffbc639b0a0d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 12:55

Target

67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe
Size

225KB
MD5

67ade77a48a6a6d90f468bf5e70a7b08
SHA1

e8d8ad0f5ce0bb206c35565613de0586ffee412a
SHA256

5c7b6abe1451f7b3e701f4517a9551d40e569931944f90295bb8ffbc639b0a0d
SHA512

6c2caacb03b9f9c5fcefe82307b782242a8ce6d88a85606e0ff6f590058bbf5216bd9cb97a455d2fc0941b723cfbc8980156371f26137ac43910d41a9cc33146
SSDEEP

3072:OJIcH/KbVY1/lHnb0YuzOn38sA7evl6DkRYIIJZjiBxuuvLaY5QG6MKvaQy+:OCcHyiNlH1n38sJ5YvbjiBxujM6MKCQH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87
PID 3276 wrote to memory of 404	3276	67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\67ade77a48a6a6d90f468bf5e70a7b08_JaffaCakes118.exe"
  2⤵
  PID:404

memory/404-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/404-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/404-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/404-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3276-0-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/3276-1-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download