bd536e7b641dd062847c9a7460806b96f4f08caa9dee8f342e66cc9feffced50

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 07:15

Target

5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe
Size

140KB
MD5

5af1b622ad147d88bfd1ed44e7cd4c70
SHA1

94ced41bd449f452575cf5403b7095a9bde5f88f
SHA256

bd536e7b641dd062847c9a7460806b96f4f08caa9dee8f342e66cc9feffced50
SHA512

1e042b19cd9d32c956b951bf376d575a2ab3024a0948152664e8da8a475572d1fe2d008c7ceea91573ccf7aace8fdf78e358b7cfd0e43c3e19e50e4e2d427c13
SSDEEP

3072:MKloQSrkKgRENEI5apGTwQqVMTW0hiJDeai1wt:61

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30
PID 2436 wrote to memory of 1368	2436	5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5af1b622ad147d88bfd1ed44e7cd4c70_JaffaCakes118.exe"
  2⤵
  PID:1368

memory/1368-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1368-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1368-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1368-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download