dadcdada8137b76ef6c4a6a5f072158b27f1ad5809bb93c77018170958b7fb56

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 00:30

Target

059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe
Size

200KB
MD5

059b0dec702a037c0920699a92d4255f
SHA1

7a4c3a4e735ae957bd20270fe953e9c15c212711
SHA256

dadcdada8137b76ef6c4a6a5f072158b27f1ad5809bb93c77018170958b7fb56
SHA512

2cbc5787e62f0e009cfa3ac7d8d2bc95f3384674d3c2427cbc9dee1d7442fb4a56cb0f77555858d486cab5060a1ae01890c50646b07bd2fa6d92ec397463c168
SSDEEP

3072:fKloQSrkKgRENEI5apGTwQqVMTW0hiJD2fNsHsSJ1LJfTAuq9s:Wv1e

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81
PID 1428 wrote to memory of 5072	1428	059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\059b0dec702a037c0920699a92d4255f_JaffaCakes118.exe"
  2⤵
  PID:5072

memory/5072-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5072-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5072-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/5072-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download