e22381dbeff091da61a57d8fe8000bb1f6d5089c17efba20e1b44e1c67219125

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 20:17

Target

5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe
Size

268KB
MD5

5d834f616b8f07ede79e489cf4cce0c5
SHA1

321d6daafd5d0387b5823f0576a084e17aa5ef7d
SHA256

e22381dbeff091da61a57d8fe8000bb1f6d5089c17efba20e1b44e1c67219125
SHA512

6e6fa07af27c870c8bba4a5749e4caeaaba3a2d9b3b74806a950ae2350a4d54c75fc50a3b72613849a6111936d26942f315addee1ecb6df9057284802c1c8afa
SSDEEP

3072:wJtn5ymi8Eu11uZaLJbN2SQ3N7Do0JgT5SVtoaKGlD8yWC242UcdRCU4J4lg4E4O:3KN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2424	2320	5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5d834f616b8f07ede79e489cf4cce0c5_JaffaCakes118.exe
  2⤵
  PID:2424

memory/2424-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2424-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-8-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2424-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download