23b42be50f9a489f2261ac1daab2e86a8f56111a3324902ac5dfb73295063dbd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 10:51

Target

0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe
Size

700KB
MD5

0dca9b6ea51b0cba175ccbb13ceec002
SHA1

b2d2fa5b7cb5175e12ee99c29a9b56158cf7c4b3
SHA256

23b42be50f9a489f2261ac1daab2e86a8f56111a3324902ac5dfb73295063dbd
SHA512

b938d8ea05e70e0c2b47b6b931c37fa345d288587d60c98e432cc965bbd62263fc0a0fa4bf97f52fe0dc7a53bf644c53168870578c562ab212d81d0100e39a23
SSDEEP

12288:0MGrl5wboul6Muh98Dt6AdkNXX1e7V96tRDXBoSHNx4l9AYPiw1A4oEPCURUKoqz:fGrlqoul6Muh98DuNXX1e7V96tFXBFt8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe
2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 1592 wrote to memory of 2356	1592	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	28
PID 2356 wrote to memory of 1348	2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	21
PID 2356 wrote to memory of 1348	2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	21
PID 2356 wrote to memory of 1348	2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	21
PID 2356 wrote to memory of 1348	2356	0dca9b6ea51b0cba175ccbb13ceec002_JaffaCakes118.exe	21

memory/1348-8-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1348-12-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2356-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2356-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2356-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2356-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2356-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download