0ee5c13b53c2cf5b1f7fcd481e993b0f9a0370c120f300fcf3dfdf70a23f4a31

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 14:24

Target

6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe
Size

188KB
MD5

6387b3232215e6ab61548553b82286d7
SHA1

8d6c0d82eb6bd331ee5f17f3ee582ab5c7f1bf16
SHA256

0ee5c13b53c2cf5b1f7fcd481e993b0f9a0370c120f300fcf3dfdf70a23f4a31
SHA512

209c92fb1ae727f0b61a9aaa6d054594d5a56306e8157850323b2243c121d29f2f4f80eb0dae202e535298cbab5648cb8a15e067761c40ed65db6a745a4880f6
SSDEEP

3072:mP4gQ2DznxT6pR4QZJF2taf8QT41JXDRW6C3UXY+0sPdO7fwG3nGLBMo7EI:3gQ2Dznx6pRhZ6+41523UX3rd8fwGXGt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe
2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2020	2564	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	31
PID 2020 wrote to memory of 1216	2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	21
PID 2020 wrote to memory of 1216	2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	21
PID 2020 wrote to memory of 1216	2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	21
PID 2020 wrote to memory of 1216	2020	6387b3232215e6ab61548553b82286d7_JaffaCakes118.exe	21

memory/1216-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1216-18-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2020-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2564-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download