2804d62022825c219710f58b1019176813c20a491b37808c6b93a97c12586e7e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:52

Target

47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe
Size

240KB
MD5

47e6e1919643de4e8e4facce695d3494
SHA1

fc489767e3d11ad0f955f920dc4523bbb0b08f2f
SHA256

2804d62022825c219710f58b1019176813c20a491b37808c6b93a97c12586e7e
SHA512

28a2123ee7ca570760f466bf8bd0852f5f5d58979467768583d424f8725d50c2c855ce08b240b13a741325d577e65ae932513e4e02b90ce60acc2413590b176a
SSDEEP

3072:SpKDbOozkX28vBLjGYktcmAziY7Kga3N4G4tMTJdMtyaSC0:KsOowGCODumAztUCGeMT/MJSC0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 2348 wrote to memory of 1940	2348	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	28
PID 1940 wrote to memory of 1196	1940	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	21
PID 1940 wrote to memory of 1196	1940	47e6e1919643de4e8e4facce695d3494_JaffaCakes118.exe	21

memory/1196-18-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/1196-17-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/1940-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1940-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1940-21-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/1940-19-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download