f5be388bd52b5d1c4eb33594d9fe170e05b8b1e80143a3d447b9891a00a0e721

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 22:23

Target

5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe
Size

255KB
MD5

5dec6ea7663ad83348128597806cd03e
SHA1

f05dd6015277e8b40a5cf31f0f526e73855cca2b
SHA256

f5be388bd52b5d1c4eb33594d9fe170e05b8b1e80143a3d447b9891a00a0e721
SHA512

9ab3f90f95a9057f2a553365dacfbf2b08773d05f4829ff991d8e5878b09b37fcc491839634ad168bba564edfb59bbe0354ad034b18c7f32757b15c66cacd2dd
SSDEEP

3072:EuG8l9/nHXAM0GnJwnG56k7EO0FgOQcWYY6LO3q3u97XJ2wsjfM+Q5WLDAl05qUj:PL9/3Bn+a3EO0F7PWuLoYwQsWoUaloT

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 2232 wrote to memory of 4568	2232	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	85
PID 4568 wrote to memory of 3524	4568	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	56
PID 4568 wrote to memory of 3524	4568	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	56
PID 4568 wrote to memory of 3524	4568	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	56
PID 4568 wrote to memory of 3524	4568	5dec6ea7663ad83348128597806cd03e_JaffaCakes118.exe	56

memory/3524-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3524-10-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4568-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4568-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4568-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4568-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4568-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download