6b1bfdf4008fc19c2e7aa8ce4549dc8345a9d09085d7331c743a4e734254894d

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 07:16

Target

44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe
Size

27KB
MD5

44d53e3d077a60b3e8712b5b13b5faa0
SHA1

c050bddf0d236d855c344bd1714b78a583c425a6
SHA256

6b1bfdf4008fc19c2e7aa8ce4549dc8345a9d09085d7331c743a4e734254894d
SHA512

111977778d0a8e75330b90bf31e2336f7c1bc3affdb064f0f1389733f4d7b06f8c91e2e9671b7dcfb67e9a13b15d9805400aa919ecc36d3264b0febe0d967ce8
SSDEEP

384:8Onrg5O2LAJibQE63BmBI1d1ttVlcRjtLudG23We:1n/2yMiUQ1ttVlcHadj31

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1276	2488	44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\44d53e3d077a60b3e8712b5b13b5faa0_JaffaCakes118.exe"
  2⤵
  PID:1276

memory/1276-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1276-13-0x0000000000400000-0x0000000000401EB4-memory.dmp

Filesize
7KB

Download
memory/1276-12-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1276-11-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1276-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1276-7-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1276-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download