cd0146c59e89e16521dc5c8e68518cedf3bd4467cbcc14aad6de6e9a62470a8b

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 03:37

Target

480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe
Size

411KB
MD5

480ccc5d0f1f199eae63ed5f181a9aee
SHA1

5665a2bcf9e2e22734f053be9a03854052707d56
SHA256

cd0146c59e89e16521dc5c8e68518cedf3bd4467cbcc14aad6de6e9a62470a8b
SHA512

af35edf433cf8ba2c9c72281d96163dc15f72106a915d4e597ed36670e5b2d1321d63d71eee64c8c91cc6d5494bae6c2c542c4d90e23f19ad7f2159dd34d8015
SSDEEP

3072:TKloQSrkKgRENEI5apGTwQqVMTW0hiJDehoFlt3ywu5t4NBu7Jl:GtFI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe
4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe
4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe
4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 3624 wrote to memory of 4492	3624	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	85
PID 4492 wrote to memory of 3436	4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	54
PID 4492 wrote to memory of 3436	4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	54
PID 4492 wrote to memory of 3436	4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	54
PID 4492 wrote to memory of 3436	4492	480ccc5d0f1f199eae63ed5f181a9aee_JaffaCakes118.exe	54

memory/3436-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3436-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3624-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3624-8-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4492-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4492-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4492-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4492-6-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download