ea62b6db9ca0a5758da07d72b0f19c609a8688063cd76a2690dea2521c44804d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 00:42

Target

2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe
Size

179KB
MD5

2e68acd2158f4da44a847790de51317b
SHA1

1b246c92296c1e353ac5790670705e6d7aa1b707
SHA256

ea62b6db9ca0a5758da07d72b0f19c609a8688063cd76a2690dea2521c44804d
SHA512

ebfb4dc55297f3aa752ed5537d0fbce1329766940a025f20b400b2e7720c8ba468681f0317ef6b7b1db34b657f974b3e48c1b641057cff1ab1b004436cdb6fac
SSDEEP

3072:j3yU4Dc4VQZM10CnnveWKsRXi+MNUlSd45LGOazD0LvSy4tWxJLsPcdzVRss8XaE:l07dnXi+5SdELxaZy4wxiczL7E

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2340	1020	2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2e68acd2158f4da44a847790de51317b_JaffaCakes118.exe
  2⤵
  PID:2340

memory/2340-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2340-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2340-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download