3959080d5b9a7f5db618e1e5db9a16e1285e85d65bba9e028a1a7e3046f45707

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 20:52

Target

0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
Size

144KB
MD5

0071be044ff6672a0aaede77273f9327
SHA1

6dcfc382fdcdfc37baea48206b54f1a5e562a30b
SHA256

3959080d5b9a7f5db618e1e5db9a16e1285e85d65bba9e028a1a7e3046f45707
SHA512

c3ead7356bbd40f0d70310ecc874baa1a6b73c3e4e08d851aeb6d024963388bb281230baee440fe6d8b6c786a68e3437e073ed03c2b8a31c7065516e7530b504
SSDEEP

768:pxcb4Ea32xyBFdnnmiUIT6Yl9AZQ+oLZ/ZiZZZIZZZZZnoPZkDCpKKtz0UF63Vq8:ImUIe+1bRFqWPypyV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82
PID 4384 wrote to memory of 2916	4384	0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\0071be044ff6672a0aaede77273f9327_JaffaCakes118.exe
  2⤵
  PID:2916

memory/2916-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2916-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download