95b61a70d07db5eb793a69582c15a1b913d4d99db8406d5d373213b3720a8721

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 04:55

Target

40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe
Size

36KB
MD5

40486d68957a8cd41e49de5b91d16e3b
SHA1

6bf629c49ddc5ddc5ada9115e5be80c6e75b4527
SHA256

95b61a70d07db5eb793a69582c15a1b913d4d99db8406d5d373213b3720a8721
SHA512

d21380ce0eecf34900a51693c17fc46bd2bfb2ccf1d974a34edfeb7e03a64c3580eef901c7b130e9a5dd4bd419aff24e737461415d29817c6987b848a00da459
SSDEEP

768:1zVsRJR1mK6CkuHJ9wK/hDQr2Pp8Uttny361PVyQa95:1mbzfZdPp5lPg5

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3148	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1264	3104	40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe	84
PID 3104 wrote to memory of 1264	3104	40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe	84
PID 3104 wrote to memory of 1264	3104	40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40486d68957a8cd41e49de5b91d16e3b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:1264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3148