354f666870ba76a381425508c8d3b25d1fb0548a9254a9da83c39a04640f9378

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:36

Target

23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe
Size

160KB
MD5

23ddaa0ae62eca83d4e5205c8e35b673
SHA1

0d0f00feae957d3e1557040377082bd675c44216
SHA256

354f666870ba76a381425508c8d3b25d1fb0548a9254a9da83c39a04640f9378
SHA512

6978236e79d77e1d1f3889ff8ef61a7f94b80ad8a8d64c1009c3cfedf07240282502c12552a75403c9b5b6419a455e618bdeec1361e0b479b841d7cdec7092ce
SSDEEP

3072:WA2npr68KhYh6h6laNT230I/eI5nl796BQzM+zZe5lmE2GO:WA2npr2oK6CI0BI5l7u7gEm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2948	2232	23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\23ddaa0ae62eca83d4e5205c8e35b673_JaffaCakes118.exe
  2⤵
  PID:2948

memory/2232-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2232-3-0x0000000000360000-0x00000000003B5000-memory.dmp

Filesize
340KB

Download
memory/2232-17-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2948-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2948-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-14-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2948-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-20-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2948-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download