37a026b8a5bfb273ffa6c3068cee3545991a675dba5202e3776a03b9f3e86c7f

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 08:38

Target

2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe
Size

224KB
MD5

2bae2aa615cfc51df99181b787558974
SHA1

ae02f1e54fa2f357872e6451ab1c94148e479492
SHA256

37a026b8a5bfb273ffa6c3068cee3545991a675dba5202e3776a03b9f3e86c7f
SHA512

56595e72d99e822100ce08450b116058cb52f13d113d3c6ab82f3a14d08329c786ddbe7eb3b85ad9bc53a2af43616f8e6045124342799ea4ff92e82813f54e83
SSDEEP

3072:UyieC1GB5XPYzCFgegV5Hmry0S5p5BYpge1CzYPcBa/2m2Ob49:AVVd5p5Y/2wk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe
2920	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2920	2864	2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2920

memory/2920-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2920-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2920-12-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2920-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2920-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2920-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2920-17-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download