72be3618013a3a20c008661f7377b279627031670cb5512869b055afd4819840

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 21:03

Target

31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe
Size

340KB
MD5

31f745b59a64aa02c51ec548434f20c4
SHA1

c830bf838961451849ef674ad278b21fd55a6f06
SHA256

72be3618013a3a20c008661f7377b279627031670cb5512869b055afd4819840
SHA512

df6fa196e0f29d0c4f21ad6b23719a7a9b0d0fc70a23fc062c2b436a5f15ac4c46dc21b08b5d1983498981a0f3582c1f13a314ac27ea6755c866c40b9a334281
SSDEEP

6144:8F8peMWaHgTupVPgAeQ+Jjgd33+692aAlwdCi:8CzmTiVFeTjuFlCi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30
PID 1948 wrote to memory of 492	1948	31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\31f745b59a64aa02c51ec548434f20c4_JaffaCakes118.exe"
  2⤵
  PID:492

memory/492-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/492-8-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/492-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/492-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/492-13-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/492-14-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1948-1-0x0000000000260000-0x0000000000263000-memory.dmp

Filesize
12KB

Download
memory/1948-0-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1948-6-0x0000000002B90000-0x0000000002C8B000-memory.dmp

Filesize
1004KB

Download
memory/1948-10-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download