095f3671fd2c3f03da39cb5f6ea5f709e08fccf2dca184dc4c00fa5be4ae1856

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 17:56

Target

291611063b3288e75217de79debb4cb7_JaffaCakes118.exe
Size

120KB
MD5

291611063b3288e75217de79debb4cb7
SHA1

09b739ce03fffaea52934e97e6d3bb2f94d68f09
SHA256

095f3671fd2c3f03da39cb5f6ea5f709e08fccf2dca184dc4c00fa5be4ae1856
SHA512

f9d1dc525e702899b91fbaca2242965852817bd9f67be06ff4ac3005d6469fec9248545f0da383dcc1fc69506961059b04d2a44ad7c5694e5abef032e50e5692
SSDEEP

1536:Zmg5Tf9u8tWJ0gL5p80K7kaVWuWmSnZQAPwQ6x25Tf9uMr:kgZfYYWJ0uMomSnZ1EcZfYM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84
PID 3020 wrote to memory of 2484	3020	291611063b3288e75217de79debb4cb7_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\291611063b3288e75217de79debb4cb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\291611063b3288e75217de79debb4cb7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\291611063b3288e75217de79debb4cb7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\291611063b3288e75217de79debb4cb7_JaffaCakes118.exe"
  2⤵
  PID:2484

memory/2484-2-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2484-5-0x0000000000400000-0x0000000000402600-memory.dmp

Filesize
9KB

Download