be54aa4591e2fd00ce2887c38721a06d80166f11489b151c265792f68a1b4cd8

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:30

Target

3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe
Size

319KB
MD5

3952e0ac79d369788f3c9f69977898f6
SHA1

566233e8758e89414d46b0f16715a5ad18243814
SHA256

be54aa4591e2fd00ce2887c38721a06d80166f11489b151c265792f68a1b4cd8
SHA512

7d9d321e608e177e12e2c7133d0c643b78eeebc2b2836b759da78eb6f4480f61c708b533b431afff6a3740c20e81991b187515b44b770e94611142dadbe98ac6
SSDEEP

6144:4JzsQD4WQg6JKRjG80Wxk9LMFNWA44CiKD2xJICJx+Co+xl3uc9kf:csQDM8hGxUJ4BhCxJzJQM9Y

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	1232	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 2516 wrote to memory of 1232	2516	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2140	1232	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2140	1232	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2140	1232	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2140	1232	3952e0ac79d369788f3c9f69977898f6_JaffaCakes118.exe	31

memory/1232-4-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1232-12-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1232-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1232-9-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1232-15-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1232-8-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1232-6-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download