50f48a92e88030dc85245e939abcff4e7e6a345d2a5a17152f38a9175283de73

Analysis

max time kernel
141s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 19:25

Target

216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
Size

1.1MB
MD5

216221ee2e17d1a9bb5b6de7666a79d4
SHA1

32735a3899097b5c073ed48ff2e9cdcdab8b0f4e
SHA256

50f48a92e88030dc85245e939abcff4e7e6a345d2a5a17152f38a9175283de73
SHA512

3a17ef8e8da75f9d58f7556194624f9839af748fbe964f0855aa3c178603b2abc9e2523e9b8a6316079e2bdf16de50adab11bc7f0170500c45963ac948f2cebf
SSDEEP

24576:Rwa9bJpyO5uWDJUt4HhlG5gYbBIq70/80zr/80z8:Rwa9bRuW1W4BlG5vWqA/L3/Lo

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
3956	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83
PID 1092 wrote to memory of 3956	1092	216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\216221ee2e17d1a9bb5b6de7666a79d4_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3956

memory/3956-0-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-1-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-2-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-3-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-4-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-5-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-6-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-7-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-19-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3956-20-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download