1d654b4c70a9aa7ba060254d4d30740ef8476c0ab63f8e29cff87a8809fd3937

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 04:49

Target

37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
Size

596KB
MD5

37c193b23d8dfad129f192b2aca02898
SHA1

794bc5b8760366d2b77d7a3b4dca685c2156d499
SHA256

1d654b4c70a9aa7ba060254d4d30740ef8476c0ab63f8e29cff87a8809fd3937
SHA512

6697990de3af0f47f51aa845c7990451878e5f4ec86d8286fa06bacbe4e04549840263bade9ddc634244444b3a30bb6d2fd17d304f5edda9df029f41aac7b2cb
SSDEEP

6144:XdDV+UWhlpakeGoFwK+UWhlpakec6rwW8CZk7:NGjApDwFjApVk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2068	1316	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
  2⤵
  PID:2068

memory/1316-1-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1316-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1316-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2068-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2068-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2068-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2068-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2068-12-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download