9e50166d69c169f0d86c815e42dc1d9c38c70fc515cda028e4d1f306a51e971f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 15:32

Target

28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe
Size

252KB
MD5

28aa4ac4e39acd3d180ec52e4469370d
SHA1

b344049b34eb27ef438c9a9e93baf4e5858c064d
SHA256

9e50166d69c169f0d86c815e42dc1d9c38c70fc515cda028e4d1f306a51e971f
SHA512

360d8401df599460a9904d5f63061f11766f4b76275530e20400823f836091b5b50c9bc7d954832b6e3db6a2488ff9301992a74b6577382f0d405987bb934690
SSDEEP

3072:dHv/Y+7IXdeOni6/EFq5jfsN4wGkRXPooOXjTM:d349fsKoOzY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe
2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2416	1712	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	28
PID 2416 wrote to memory of 1204	2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	21
PID 2416 wrote to memory of 1204	2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	21
PID 2416 wrote to memory of 1204	2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	21
PID 2416 wrote to memory of 1204	2416	28aa4ac4e39acd3d180ec52e4469370d_JaffaCakes118.exe	21

memory/1204-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-10-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2416-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download