6fb460f9e91351e999c6c8ca8fbc8e70e055ae606f3bc2bf39410f41c1cdabbb

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 05:26

Target

5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
Size

272KB
MD5

5aa2d37f12147625b61041146ce3d7c3
SHA1

7fdf207333a2a38f5178ef515f353a7576f1b88f
SHA256

6fb460f9e91351e999c6c8ca8fbc8e70e055ae606f3bc2bf39410f41c1cdabbb
SHA512

d09cf227e62be92ccb111a3410fa12b78a281a0d21403d5f54ef28779bc5fcc72462d9545207ebbecd5f1e16c1451b6c8f62f039d3a6956f0341179a2aa16a12
SSDEEP

1536:VkKCMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6wkEkotu:i+X0e1FB/DpKjCLHAkEL2OUsLL5A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84
PID 5028 wrote to memory of 3476	5028	5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5aa2d37f12147625b61041146ce3d7c3_JaffaCakes118.exe
  2⤵
  PID:3476

memory/3476-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3476-3-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3476-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3476-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3476-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download