004776a9ca888052a9c15442984614fd46247407ebb1a8889c99f7ae54bfa9ea

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:41

Target

4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe
Size

112KB
MD5

4d3416d460fdc0c552df90b5293ac1ca
SHA1

eeee792d198a0b971aa1d7ebd46bc31e7d13f07e
SHA256

004776a9ca888052a9c15442984614fd46247407ebb1a8889c99f7ae54bfa9ea
SHA512

4adfc62a52f8c17778a18ed0c6c2e51eeb72204a5ace7c7df19cbedfa2635d16bb658e21bcc2425c5f0fbda227bfcd2a6d6858bd2ed85cc852bb08ff7c615cdf
SSDEEP

1536:gtAM6OYheqYZDyyCa7A/q/JoLwOt73Lp9zsI:XM6jequXiYoLwiBVsI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe
2472	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2472	2736	4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4d3416d460fdc0c552df90b5293ac1ca_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2472

memory/2472-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2472-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2472-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download