c447a3dd85a50c6a457bfd3dbe679a90b357a3243c5e1bf3e61e2e6df007d2d6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 18:32

Target

3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
Size

172KB
MD5

3e6a8bc8356279e1064e6a1efde7bf9d
SHA1

e7a7baf9471d803d02c68322dc458a92e3260aeb
SHA256

c447a3dd85a50c6a457bfd3dbe679a90b357a3243c5e1bf3e61e2e6df007d2d6
SHA512

10dbbb35b06620b105254b65656fe8cce18e5bbf87448445642b0928d05eb502fda043dc83b22d6815b3b29e675aa0e390cb5ffae169cd8d50a81409f8bca3c5
SSDEEP

1536:0AKmzOqhSYqs+8u2LY/04UgoTkAUKzwDgw/sAT:XLca+56U04ZoTkAUKzwDlsm

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 set thread context of 0	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 2456	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe	83
PID 856 wrote to memory of 0	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
PID 856 wrote to memory of 0	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
PID 856 wrote to memory of 0	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
PID 856 wrote to memory of 0	856	3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3e6a8bc8356279e1064e6a1efde7bf9d_JaffaCakes118.exe"
  2⤵
  PID:2456

memory/2456-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2456-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2456-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download