f970d594b30792f215656adaaf67a53e48d87988d5d28f9ae5c2657199056597

Analysis

max time kernel
15s
max time network
21s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 11:11

Target

2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe
Size

31KB
MD5

2c1b1e005249bab3034fa8a530798794
SHA1

0d6628f062b3214a1df6661b5b71eee4f1b8edba
SHA256

f970d594b30792f215656adaaf67a53e48d87988d5d28f9ae5c2657199056597
SHA512

07ed4f95b901a91521221ed4236bb77f92b134acd682062c920648c59028fa0424c1075369b7295d9ee5cb1d722ee624e12012749a4cf413a62fb4310ea0ca64
SSDEEP

384:spvljIWkJQAQioBgS/c5rLPDK047F9FvKobvOa1jT:snEbli/cPbGZ9NKSmaN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2988	1044	2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2c1b1e005249bab3034fa8a530798794_JaffaCakes118.exe
  2⤵
  PID:2988

memory/1044-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1044-16-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1044-3-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2988-12-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2988-14-0x0000000000400000-0x0000000000401E00-memory.dmp

Filesize
7KB

Download
memory/2988-13-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2988-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2988-8-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2988-6-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2988-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download