cde5f14190baf96447185088bc239491a0250176c718382bcc96b87184454e21

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 03:37

Target

18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe
Size

152KB
MD5

18a4844d12a65ff049802618b476c0ea
SHA1

0e3418a0f1fdc4d13605dfefe0d11fb54547b809
SHA256

cde5f14190baf96447185088bc239491a0250176c718382bcc96b87184454e21
SHA512

67ae9ca0acde2979264f186a3f0242215fe06c1e1049ed7a5b3531a6519008d76d7838b019273cf83c42b6d672524937112d2c16dc7ef5cfe5c0861d7ac372e9
SSDEEP

3072:wfAJEb8NLNJEq1nri/C6Vuts7jWmJSQlSRxdA7:wAJqqLN+8Fwuts7jWSNwRx27

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe
2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2056	2964	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	28
PID 2056 wrote to memory of 1360	2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	21
PID 2056 wrote to memory of 1360	2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	21
PID 2056 wrote to memory of 1360	2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	21
PID 2056 wrote to memory of 1360	2056	18a4844d12a65ff049802618b476c0ea_JaffaCakes118.exe	21

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
64e540d3c6f17d3f95f9370bf1bdbd81

SHA1
b72e541c5751ffd99598f86827370fea34150a4a

SHA256
cd7a4c4ce1bcddae2ec0440e67fb81a4400cbc233837dbab2abf1a268cc31855

SHA512
ec6517f9d76a29741d47defef0d98ac6f75103fa90d7c38d203e873abdf50f2cd7f91227cf26a5dc811406719c27266b8381d1e1f702db0587fe565a04840656

Download Submit
memory/1360-24-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1360-27-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2056-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-22-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2964-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2964-21-0x0000000000430000-0x000000000044F000-memory.dmp

Filesize
124KB

Download
memory/2964-20-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2964-37-0x0000000000430000-0x000000000044F000-memory.dmp

Filesize
124KB

Download