62c0941a0b928edaefb6385b39154f9ab116bd8d9cf9aa780f793f09af973d68

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 18:17

Target

3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe
Size

108KB
MD5

3a3cadb902b345e7de3fee78ab1dafef
SHA1

6cbb48b90da02413a6f03d4780acd78d5ee53635
SHA256

62c0941a0b928edaefb6385b39154f9ab116bd8d9cf9aa780f793f09af973d68
SHA512

1e5eeaeb41d26f1048f26201c2a7031ecceceab2888998743819a9a70e060810d4f283b2aba2fd2d45df737a3b69dc3300ebc93a41030e6cc9643ad3ad7a53a0
SSDEEP

1536:OSB6pSPWEUD0FOi7tepjXV0ppODldztX8fmtRGtLL6:OFpSPVOeKjyODlvr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe
1724	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1724	2436	3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3a3cadb902b345e7de3fee78ab1dafef_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1724

memory/1724-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download