9815291be0b9c2751a4b6f80d20aa3a7b345f05d5af65803cc6bd1d7b936c9cb

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 04:25

Target

02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe
Size

11.2MB
MD5

02ca776f1433b26f8e22470d5e14e691
SHA1

f66a1c6c35f60b26b15d61e6127b1a8d4b96b7b5
SHA256

9815291be0b9c2751a4b6f80d20aa3a7b345f05d5af65803cc6bd1d7b936c9cb
SHA512

a070226461822b28be76f9dcc9217836e8992026b22386848211a72c3d5d8914d8cc70e56ef543b92b5a07d70c1c4c3298dd004870100aad110e55f75779e658
SSDEEP

3072:mS0QW1HtJlsMzvVGlah6sSb93YwbZfl4KVmulbuQfQM28zV57P/dLC35sK:vp2HtJ5VGgV5ml4KVmulbuQl28z+m

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4420 set thread context of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85
PID 4420 wrote to memory of 3080	4420	02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\02ca776f1433b26f8e22470d5e14e691_JaffaCakes118.exe
  2⤵
  PID:3080

memory/3080-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3080-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3080-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download