94d33e76b4bcc14f2c9b71fcc307c5501335e2cebf9317d221ca5e6bf52dce33

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 15:26

Target

63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe
Size

104KB
MD5

63bba77caa04523b94a02eccb2afef46
SHA1

8c2a3ff89e06df1e7455d00e4201318a917e5b77
SHA256

94d33e76b4bcc14f2c9b71fcc307c5501335e2cebf9317d221ca5e6bf52dce33
SHA512

e0741bc3cb1f419ef8d2c632c306b728eb363af7d4b9a97db0309c01ffb5c76e02ee32230323c8258b51d394ca8f6ff34e999b2d3e3c36c9b8740907c60adfd7
SSDEEP

1536:lP7LRKwF6FuBTV+ernvKVVQGRVSMgvVWwYZ+jblXOTjLoPMZ2gUSn:FoJkp+ernvKVmGSMgvkChJPyP3n

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29
PID 2432 wrote to memory of 2736	2432	63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\63bba77caa04523b94a02eccb2afef46_JaffaCakes118.exe
  2⤵
  PID:2736

memory/2736-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2736-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2736-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2736-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2736-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download