0fa9bb7af6970dfe7e98a5951c61d2053ba9ae1f9dded0e7671cdee5ff50c1ef

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:31

Target

5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe
Size

267KB
MD5

5c577b5e6aed579acdeaec8413a7fe5d
SHA1

4cafe18158cbd22370c7b391c2eb287aef66b1e6
SHA256

0fa9bb7af6970dfe7e98a5951c61d2053ba9ae1f9dded0e7671cdee5ff50c1ef
SHA512

a49f2085956cbe0769bad8f1629c1edb90fd9793a4edcdd5a7e410ef8c520de334ccdd74464b444c53d843264f77bf921692d6172676b911e2a35c65a1775d19
SSDEEP

3072:ZiO/egDhH5V61iRgnMyOQniQJOJsxRi/ZOAAu5dvup4fk9wpQN4p:l/1zI1RMyxniQjxs/w4d2pPcp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe
2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe
2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe
2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 3060 wrote to memory of 2740	3060	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	85
PID 2740 wrote to memory of 3468	2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	56
PID 2740 wrote to memory of 3468	2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	56
PID 2740 wrote to memory of 3468	2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	56
PID 2740 wrote to memory of 3468	2740	5c577b5e6aed579acdeaec8413a7fe5d_JaffaCakes118.exe	56

memory/2740-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2740-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2740-9-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2740-14-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3060-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3060-1-0x0000000000401000-0x0000000000430000-memory.dmp

Filesize
188KB

Download
memory/3060-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3468-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3468-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download