003ec5656debf2d2c4405f0b3562eb0e34aeaa76ade67af2ff475e23aca9d5df

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 15:19

Target

5c8154306545e21dee848386bee91663_JaffaCakes118.exe
Size

32KB
MD5

5c8154306545e21dee848386bee91663
SHA1

dc3b6906b81dca63437e3bc902a7a0b640420941
SHA256

003ec5656debf2d2c4405f0b3562eb0e34aeaa76ade67af2ff475e23aca9d5df
SHA512

90c21e9818fe8cbaf718e642a1487206e73569a2e959545e7984d50fd968ff3b167e7cd06ed8c93e5b14cd5c72967b6b1927e39da990ce33b21d193d30e3075d
SSDEEP

384:NKDWsvu9KDwzhEPKDlyAFqWI56KDlZElKDwz5svu2KD:rVzhE0y8AzZEtzF

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	5c8154306545e21dee848386bee91663_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1548	2324	5c8154306545e21dee848386bee91663_JaffaCakes118.exe	97
PID 2324 wrote to memory of 1548	2324	5c8154306545e21dee848386bee91663_JaffaCakes118.exe	97
PID 2324 wrote to memory of 1548	2324	5c8154306545e21dee848386bee91663_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\5c8154306545e21dee848386bee91663_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c8154306545e21dee848386bee91663_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Windows\System32\wgaprem32.dll
  2⤵
  PID:1548