78c13dfca5b5544c5b385ffd08ca6c65b0cc0bc1f8f4e255c766b7f58ad6f95a

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:54

Target

5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe
Size

454KB
MD5

5b3f7c6824a6df6221c2cceaeffab3c6
SHA1

a95fac4980d175e70a0a62185db04dcb2eacc14f
SHA256

78c13dfca5b5544c5b385ffd08ca6c65b0cc0bc1f8f4e255c766b7f58ad6f95a
SHA512

473fdc6b1107d3ead8ea09d0cdd842c3c63a3d220e15769a785b71e03d76050679ae4debcf8b7b008bd95213a235e002d99e1288a13f39f926bdc5f209bfb795
SSDEEP

6144:6MRTZvXgTTSjabKwe7zv2ibKwe7zv24oRQ8:6MRTZgTvKwGzRKwGz4Rn

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe
1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe
1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1628 wrote to memory of 1848	1628	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	30
PID 1848 wrote to memory of 1200	1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	21
PID 1848 wrote to memory of 1200	1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	21
PID 1848 wrote to memory of 1200	1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	21
PID 1848 wrote to memory of 1200	1848	5b3f7c6824a6df6221c2cceaeffab3c6_JaffaCakes118.exe	21

memory/1200-22-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1200-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1628-9-0x0000000000230000-0x0000000000282000-memory.dmp

Filesize
328KB

Download
memory/1628-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1628-14-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1848-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1848-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1848-31-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download