2cc32085a6098cd9497fe1800751503e4c1f72a65905eacfc5a43b059f73c8b7

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 02:50

Target

f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe
Size

55KB
MD5

f71ade8f3483931bd6614b38c35634f3
SHA1

943fd236f7fd7d69ff11cc6df19afbc96e39bc90
SHA256

2cc32085a6098cd9497fe1800751503e4c1f72a65905eacfc5a43b059f73c8b7
SHA512

ea836e28b29dcbb51efb51908d96c436b07329ee1d82640047bf5ff500d8c5f410e15e0a5e01a3e19590dd09e3293d31c75be952d4d28cfeca587dec0fad295a
SSDEEP

768:2Hw5yeww45SX5wPGuL482mjdiSk9J4cbmCNjE1mkOt1GV6xCk8Q:2LewhSX5Yg82mQrJdN41mkO/G60k8Q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe
3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3920 wrote to memory of 3636	3920	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	92
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56
PID 3636 wrote to memory of 3544	3636	f71ade8f3483931bd6614b38c35634f3_JaffaCakes118.exe	56

memory/3544-9-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/3544-11-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/3636-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3636-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3636-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3636-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3636-8-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3636-17-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download