a554090e7580c62a456ee9c4291ca59809f4f4e8c867315a9951227e7c04c956

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 14:45

Target

352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe
Size

264KB
MD5

352a22f1e786aa734773344e3c8466b7
SHA1

6e400068df5a20f1b7b22961139fc9f212f7e38f
SHA256

a554090e7580c62a456ee9c4291ca59809f4f4e8c867315a9951227e7c04c956
SHA512

6b14cfa2b2fc593063f07ccf01998b07514d96def77949bb539c8e231ece89a3208bdde6cac36269ba5e900bed3d8a91c7549fc8e93f64fa129a8d777b39057f
SSDEEP

1536:PMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVOqnjK01+fsOn:EX0e1FB/DpKjCLHqjK2E3gG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82
PID 452 wrote to memory of 3340	452	352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\352a22f1e786aa734773344e3c8466b7_JaffaCakes118.exe"
  2⤵
  PID:3340

memory/3340-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3340-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3340-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3340-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download