449b5bb355e1a1cbd27b1f34119e056429fd0fb7bdc64769f7f0b30a1a99a590

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:36

Target

088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
Size

256KB
MD5

088b7d219c10187f8594fdc3143b9425
SHA1

a95a060fb7f93363f149827542cf6482f23bfe9c
SHA256

449b5bb355e1a1cbd27b1f34119e056429fd0fb7bdc64769f7f0b30a1a99a590
SHA512

0a1b6c0de917b11c679b8e9d67dd1ad98e59140e19489e62f88585cb181cf45c07419173635a927c5691ef3669f512ddf7e21c658c7d452df45d1ca45778ff5c
SSDEEP

1536:mVY2SzOqFK0OEe4qeXwbQgsfPSOwSIkGtiiFJ2Sld1eBayDhRCceKkQhljti3mmi:m2LIKeh+MQgzVpkSlQXjg3mmWz6tCtn

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 set thread context of 0	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 1332	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	29
PID 2900 wrote to memory of 0	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
PID 2900 wrote to memory of 0	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
PID 2900 wrote to memory of 0	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
PID 2900 wrote to memory of 0	2900	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
PID 1332 wrote to memory of 1204	1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	21
PID 1332 wrote to memory of 1204	1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	21
PID 1332 wrote to memory of 1204	1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	21
PID 1332 wrote to memory of 1204	1332	088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe	21

memory/1204-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-9-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1332-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1332-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1332-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download