6fb460f9e91351e999c6c8ca8fbc8e70e055ae606f3bc2bf39410f41c1cdabbb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:26

Target

5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
Size

272KB
MD5

5aa2d37f12147625b61041146ce3d7c3
SHA1

7fdf207333a2a38f5178ef515f353a7576f1b88f
SHA256

6fb460f9e91351e999c6c8ca8fbc8e70e055ae606f3bc2bf39410f41c1cdabbb
SHA512

d09cf227e62be92ccb111a3410fa12b78a281a0d21403d5f54ef28779bc5fcc72462d9545207ebbecd5f1e16c1451b6c8f62f039d3a6956f0341179a2aa16a12
SSDEEP

1536:VkKCMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6wkEkotu:i+X0e1FB/DpKjCLHAkEL2OUsLL5A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2492	2628	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
  2⤵
  PID:2492

memory/2492-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2492-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download