aea22da7cb05c4c91db2ea76cbb525e549865e3beb2b4400171e315785fdd998

Analysis

max time kernel
140s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 05:07

Target

18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe
Size

160KB
MD5

18e284ab6527943548a0ac9b4f074adb
SHA1

4c0fdee363a22850afe004162e00c958c75db290
SHA256

aea22da7cb05c4c91db2ea76cbb525e549865e3beb2b4400171e315785fdd998
SHA512

2e043e72019c9ee02825105d753bbcaa4e7e174a71fb52afc34ea3859f1043ef7993ccd2ddc5cb5be2f4577192a71693d000a9def1c7f80ef7e8416c8e00ccd3
SSDEEP

3072:cXhsl1zE0jih1SsynY2KGlCWUmngsiNHUlkVSofggYnYdtdeL67vBzTr:cR6E0jmyn3yrlZfYYdneL6p/

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 544	3912	18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe	85
PID 3912 wrote to memory of 544	3912	18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe	85
PID 3912 wrote to memory of 544	3912	18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18e284ab6527943548a0ac9b4f074adb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\274974DD7F6D2096037020F63E.exe
  2⤵
  PID:544

memory/3912-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3912-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3912-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download