7dd172fda81cd6767cecb233256923614d8922b8adb2e442134b6c26c5bc86ab

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 16:53

Target

eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe
Size

84KB
MD5

eb8acc0ca9542fb501658d58cc9b52fd
SHA1

a6f82c335b55ac912a053d4480cd09940bfb9dc4
SHA256

7dd172fda81cd6767cecb233256923614d8922b8adb2e442134b6c26c5bc86ab
SHA512

05aac3e87b77f771902835b852ef1f3489616c563c2f0bfae8d0d868a44fd1566bfde6d0116b501139fb4b96527fa3f4c8fbc9b0f7750099c7f8df5d957b5ec1
SSDEEP

1536:LTgEVoPf54tuylLoLz0B4CMpdIrE0amyndR+lyWd6MMn/4/:vfVoPmB0LwB/CIramydRcyWYMMn/K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe
1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1796	1304	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	29
PID 1796 wrote to memory of 1208	1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	21
PID 1796 wrote to memory of 1208	1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	21
PID 1796 wrote to memory of 1208	1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	21
PID 1796 wrote to memory of 1208	1796	eb8acc0ca9542fb501658d58cc9b52fd_JaffaCakes118.exe	21

memory/1208-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1208-16-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1304-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1304-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1304-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1304-3-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1304-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1796-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1796-9-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1796-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1796-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1796-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1796-25-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download