e3a62cfb98cf630c8b4b46f94389ce3c93d8a30d61ad17009959b2345a84be1a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 22:29

Target

0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe
Size

339KB
MD5

0fc3462284d8202b5656995b9f9352dc
SHA1

b5885a8769060da7834fc1e1899d1a50815033fc
SHA256

e3a62cfb98cf630c8b4b46f94389ce3c93d8a30d61ad17009959b2345a84be1a
SHA512

5538e1136e951bb47be9acef827ffbe9660639914c1846df5b0865278dc435092bf7ca4543ce96a48babd429fae5a531b60521d300a563bd7ea7d4101057a194
SSDEEP

6144:oG1FlaDQ9eNTh5sK0myEpLXfvH2ejrRzk2IlAzo8t+8ELGJ8e:lFwJNlR0mykzkczoO+8E68e

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe
1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 2104 wrote to memory of 1808	2104	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	28
PID 1808 wrote to memory of 1196	1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	21
PID 1808 wrote to memory of 1196	1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	21
PID 1808 wrote to memory of 1196	1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	21
PID 1808 wrote to memory of 1196	1808	0fc3462284d8202b5656995b9f9352dc_JaffaCakes118.exe	21

memory/1196-20-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1196-24-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1808-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1808-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-23-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1808-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2104-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2104-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download