1d654b4c70a9aa7ba060254d4d30740ef8476c0ab63f8e29cff87a8809fd3937

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 04:49

Target

37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
Size

596KB
MD5

37c193b23d8dfad129f192b2aca02898
SHA1

794bc5b8760366d2b77d7a3b4dca685c2156d499
SHA256

1d654b4c70a9aa7ba060254d4d30740ef8476c0ab63f8e29cff87a8809fd3937
SHA512

6697990de3af0f47f51aa845c7990451878e5f4ec86d8286fa06bacbe4e04549840263bade9ddc634244444b3a30bb6d2fd17d304f5edda9df029f41aac7b2cb
SSDEEP

6144:XdDV+UWhlpakeGoFwK+UWhlpakec6rwW8CZk7:NGjApDwFjApVk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84
PID 2432 wrote to memory of 1612	2432	37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\37c193b23d8dfad129f192b2aca02898_JaffaCakes118.exe
  2⤵
  PID:1612

memory/1612-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1612-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-10-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2432-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2432-1-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2432-8-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download