6f906a8f593d1bed2e17a4f5187bc8e19949fa215089795a827af2874933654f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 21:23

Target

ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
Size

276KB
MD5

ec055ff1cd941c7c38b576b141d5cadf
SHA1

e7ab65ec3fa574810a3f838b766e72ef6c91a44b
SHA256

6f906a8f593d1bed2e17a4f5187bc8e19949fa215089795a827af2874933654f
SHA512

4d47844e1509c5060700069f7b3ce2e54369c3d780f1e6840a4701b5011dd0c363d54b9ae47a78676208aee6bd56536600b7226577b46e6ce4ee45632fe160c5
SSDEEP

6144:sjVLzasdBP33wUmbZO7cLoEYXQjSWAifHd+Esnh0PSob/qh:ibTfgLo27fHd+BnuPSSm

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 set thread context of 0	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2228	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	28
PID 2164 wrote to memory of 0	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
PID 2164 wrote to memory of 0	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
PID 2164 wrote to memory of 0	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
PID 2164 wrote to memory of 0	2164	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe
PID 2228 wrote to memory of 1356	2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	21
PID 2228 wrote to memory of 1356	2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	21
PID 2228 wrote to memory of 1356	2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	21
PID 2228 wrote to memory of 1356	2228	ec055ff1cd941c7c38b576b141d5cadf_JaffaCakes118.exe	21

memory/1356-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1356-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2164-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2164-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2164-8-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2228-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2228-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2228-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2228-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2228-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download