ab8410e12dd650817514b976abed360044a2afd09ca94a254b5b46cffebb7d4b

Analysis

max time kernel
12s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 02:59

Target

3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe
Size

686KB
MD5

3fece8b93e574c9aed839e91bc7139fd
SHA1

43b2f1322d148de7289328559f96e3e6d9e5b9e8
SHA256

ab8410e12dd650817514b976abed360044a2afd09ca94a254b5b46cffebb7d4b
SHA512

22375acc4c89bf66bd3b4269a17da0a881cb61ae2db790aed03fa7b2dee4747ce9adb7d63caa86e15dea9e0b90a3d9b9998dd06d3bfff8165e49afb26ec4166a
SSDEEP

12288:1ITW0SsSYpDlta31MUhXjNM3PQ7TxIcntupZB78FsWGIph8d:1ITW0Ss3D7aucXjAPQ7l30pb70Gd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe
2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2884 wrote to memory of 2412	2884	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	29
PID 2412 wrote to memory of 1196	2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	20
PID 2412 wrote to memory of 1196	2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	20
PID 2412 wrote to memory of 1196	2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	20
PID 2412 wrote to memory of 1196	2412	3fece8b93e574c9aed839e91bc7139fd_JaffaCakes118.exe	20

memory/1196-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1196-25-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2412-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2412-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-0-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download
memory/2884-18-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download
memory/2884-19-0x0000000000548000-0x0000000000550000-memory.dmp

Filesize
32KB

Download
memory/2884-4-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download
memory/2884-1-0x0000000000548000-0x0000000000550000-memory.dmp

Filesize
32KB

Download