c0fb7693f2205b10dcfd2a11c5ac205313857e03d83c4769fb7f5f2f92586148

Analysis

max time kernel
91s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:25

Target

3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe
Size

152KB
MD5

3759c33761a0619fd66db348deddb6cb
SHA1

9706bdf450ace719f76f742a7fd1c33343e8dfa5
SHA256

c0fb7693f2205b10dcfd2a11c5ac205313857e03d83c4769fb7f5f2f92586148
SHA512

53321b06358c7e491aa6aa1b1075f797b9bead3c8493e64503deeacfa3a28bbe661cac30a7d0ba5db04b3611394f89a627eb7e7089c1caa3f81119e8ac0bd57d
SSDEEP

3072:K2U+5FI+QtltRQ+cTJNzyZjgvdQ4fRXdUA8hXANZTcKBuiAlsPH:NU2a+QLtRyTJQ1gvdPsAmeZ/D1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe
1128	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84
PID 4796 wrote to memory of 1128	4796	3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3759c33761a0619fd66db348deddb6cb_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1128

memory/1128-4-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-14-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-12-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-17-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1128-19-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4796-0-0x0000000000400000-0x000000000046A110-memory.dmp

Filesize
424KB

Download
memory/4796-1-0x0000000000401000-0x000000000044D000-memory.dmp

Filesize
304KB

Download
memory/4796-11-0x0000000000400000-0x000000000046A110-memory.dmp

Filesize
424KB

Download