602966a9dc933e21b8bc7dd01d7a271c4f2fe5a53888570a23d872e92abd247b

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:04

Target

30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe
Size

148KB
MD5

30ae948e481ce23d3c3d82ee7c51a834
SHA1

524605eca13b21a6830984b0c4594096354cf255
SHA256

602966a9dc933e21b8bc7dd01d7a271c4f2fe5a53888570a23d872e92abd247b
SHA512

fc3e77a4026fff4a2aae11a2773afead19ac3b29fc3c1780f369b578f09d135cc51f9efcf0ba69164f842ac6575d4a3eca00126362b7f28411c21d605317c831
SSDEEP

768:6Z9nw/qiJm5HO7AK+QdolDVGwP/pJENjqWEURxrmC7eQvij2aQbRyflmUFPM1zS+:6OtIVXK+QmlHE79W22FPeOnWAMaUN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83
PID 1412 wrote to memory of 4348	1412	30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\30ae948e481ce23d3c3d82ee7c51a834_JaffaCakes118.exe
  2⤵
  PID:4348

memory/4348-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4348-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download