93d5eeb36eab132d9aaa18a07e7ec05a311733486a1a513972d7492777b1f7cd

Analysis

max time kernel
21s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 08:51

Target

340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe
Size

2.3MB
MD5

340c4cf827402bc19f56a51378c521f4
SHA1

98cfce7bcb50fd3e40c4f2546782981283c4fa0d
SHA256

93d5eeb36eab132d9aaa18a07e7ec05a311733486a1a513972d7492777b1f7cd
SHA512

c191eaef53b37314d4a9af339cebb7a20aa6d20995b9953375878f0a3173b10063d988763852862f8efe8843fd7a858d6452c452e314f16c4b78ef0254606010
SSDEEP

49152:U9mRDDmrw/zv9wKTLe/vLHZfFsHF59BTtjvV02/NhV:U93U/zRLmzpkBt3

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2908	2552	340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe	29
PID 2552 wrote to memory of 2908	2552	340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe	29
PID 2552 wrote to memory of 2908	2552	340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\340c4cf827402bc19f56a51378c521f4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 480
  2⤵
  PID:2908

memory/2552-0-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2552-1-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2552-2-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2552-3-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2552-5-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2908-4-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download