9f52b7d817d9c63883930dc18423feebb5c64e89ce4a93eca3330fca58ff1fd3

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 01:38

Target

5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe
Size

118KB
MD5

5e8a9ae53fbc20db76f904e2c832871f
SHA1

9467e182f5c2405f6c3973f6f2824b47fbf61275
SHA256

9f52b7d817d9c63883930dc18423feebb5c64e89ce4a93eca3330fca58ff1fd3
SHA512

f65575aad59a591f3e1b13bb898a00b8b57fd742ee1a23e09e72e5f9b9ccb1892cb5f7ff534f5bb86a87cf33e4501dfcdf81edcbbdc7d9a4c5205f9d0a22a161
SSDEEP

1536:yHVwy/aXw33eaFLxjD/7kHnAZLZqk0R2DNHhqbX5ds52AxP5uX2itw+XQ2knf:p60exPYHnAG5SHQbX5I2AxP8GitwWYf

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4900	wmpnetk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4152 set thread context of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84
PID 4152 wrote to memory of 4900	4152	5e8a9ae53fbc20db76f904e2c832871f_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\wmpnetk.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/4152-0-0x00000000745E2000-0x00000000745E3000-memory.dmp

Filesize
4KB

Download
memory/4152-1-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4152-2-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4152-12-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4900-5-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4900-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4900-13-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download