88eb85871ab342a21d7d9593b74430a7d6c16e772eef720fbe6ef871f4587fc4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 08:43

Target

451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe
Size

104KB
MD5

451843e64bc8afdeb9120a16fed937d2
SHA1

ae294f9e08fdd78aba159676d46f238147265c5f
SHA256

88eb85871ab342a21d7d9593b74430a7d6c16e772eef720fbe6ef871f4587fc4
SHA512

7f142384c321c7bfdc6c48d0dc8405f20cdff3bff891cfca82a414d0f35cf750935debf60e5e8ba476c677b7e92a1806b69ef556ffd954903c6acc425a216ef2
SSDEEP

3072:ru/DHLJmLc2Rk5ma7Bcfu0u/E1gmuYIkYL2:+Oc2R4TBT0WzLkF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe
2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2500	2480	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21
PID 2500 wrote to memory of 1212	2500	451843e64bc8afdeb9120a16fed937d2_JaffaCakes118.exe	21

memory/1212-14-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1212-21-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2500-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2500-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download