a6e8dd4aeaabc232d946d3d50e04f4069b43a319cef47a5fd6e98686abce8a85

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:43

Target

65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe
Size

183KB
MD5

65171d1736e13b7c7ba8ab4d1d7b5694
SHA1

2a670fe0e77d59d7ce124b6ffb8c04ded814c0de
SHA256

a6e8dd4aeaabc232d946d3d50e04f4069b43a319cef47a5fd6e98686abce8a85
SHA512

57d7e3187166ba4fd700ec5871bf1a93f79c6231b7c1b02493fd07002e579b7cfd49a0d040b254f5eb9663047ba53993097cb136911c961641981afa175cbc3f
SSDEEP

3072:3y8K1XMiHOxiyMMJxDmWKuT5iLMR2+q+T6HIVdC0jUiqJr8lM94Co/wZ5Oj1o2Ww:3l28FiybxGuT5nRrq+6YdC0j9qt8TR/B

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1932	2200	65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\65171d1736e13b7c7ba8ab4d1d7b5694_JaffaCakes118.exe
  2⤵
  PID:1932

memory/1932-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1932-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1932-9-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1932-12-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2200-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2200-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2200-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download