a90577409d62313c8816fe8f4db40084be159e2573f2aee1481857cb6a94825b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 13:04

Target

3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe
Size

44KB
MD5

3d7d5ec67ba9d861a9a12c6ca373d3bc
SHA1

3ddda62bd00167a49508bd7ba85fc881972189c2
SHA256

a90577409d62313c8816fe8f4db40084be159e2573f2aee1481857cb6a94825b
SHA512

e10ba423d7679a782143b200afa91d67b70be9187aa68e3abf23a29fb963342ec3b4b873a3b3a96ed448db0a3fcfe8fc79ac92d0f20c6ade2418b63d10060bab
SSDEEP

768:DcxKN61v0Od6bEDAIz4PJgwdklkAwy8kAAeO+ob1RDlsKFWQUS:DcuOd6ADAI0PJgwdkTwy8kAAeO+ob3ew

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83
PID 400 wrote to memory of 620	400	3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\3d7d5ec67ba9d861a9a12c6ca373d3bc_JaffaCakes118.exe
  2⤵
  PID:620

memory/620-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download