3959080d5b9a7f5db618e1e5db9a16e1285e85d65bba9e028a1a7e3046f45707

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 20:52

Target

0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
Size

144KB
MD5

0071be044ff6672a0aaede77273f9327
SHA1

6dcfc382fdcdfc37baea48206b54f1a5e562a30b
SHA256

3959080d5b9a7f5db618e1e5db9a16e1285e85d65bba9e028a1a7e3046f45707
SHA512

c3ead7356bbd40f0d70310ecc874baa1a6b73c3e4e08d851aeb6d024963388bb281230baee440fe6d8b6c786a68e3437e073ed03c2b8a31c7065516e7530b504
SSDEEP

768:pxcb4Ea32xyBFdnnmiUIT6Yl9AZQ+oLZ/ZiZZZIZZZZZnoPZkDCpKKtz0UF63Vq8:ImUIe+1bRFqWPypyV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2864	2232	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
  2⤵
  PID:2864

memory/2864-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2864-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download