1ba3706cd0d9c548b657fe7a1b0aa093eb0462f4a4b6cc9d1dbf252d2a78327e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 19:49

Target

0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe
Size

316KB
MD5

0f505d0bddef5534f5ae1484adc2117c
SHA1

fb807fde3c6625700f3a35eaaadf68e513bd410f
SHA256

1ba3706cd0d9c548b657fe7a1b0aa093eb0462f4a4b6cc9d1dbf252d2a78327e
SHA512

6ab6889a487746cc0f2e3ce1e2b8ed3ae711b438bfc21f5876695747f42295d85773a5264982cf5e07cacc195650d259f64cd00a4468b25d80e6cd7033bdcddb
SSDEEP

3072:xnoF3CkEnm23lSuURxK/paQFVCIyxZtIbLPISKaTMjD2B9r3nWGtot+OO2eT868t:xpKqeN6A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe
2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 1344 wrote to memory of 2216	1344	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	28
PID 2216 wrote to memory of 1252	2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	21
PID 2216 wrote to memory of 1252	2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	21
PID 2216 wrote to memory of 1252	2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	21
PID 2216 wrote to memory of 1252	2216	0f505d0bddef5534f5ae1484adc2117c_JaffaCakes118.exe	21

memory/1252-17-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1252-20-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2216-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2216-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2216-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2216-15-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download