72b2ec7c82f6038f1fb732ec31d5fed37d5d7fed7f8f5da6b63c2afde16c1629

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 02:53

Target

65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe
Size

276KB
MD5

65dc1ab95be8cf374cb3f62eed84789f
SHA1

80eb21e8e1ca0d7a919fb1c8b193a8d7458f155f
SHA256

72b2ec7c82f6038f1fb732ec31d5fed37d5d7fed7f8f5da6b63c2afde16c1629
SHA512

7dcf913f365f3304c2398d47e7a241c77a592d02eecab13ce0a6d7098a04e791d08479fa1ec560fa5707daffd9e5696e9d50cdeb1a2a604d957cfbaac849d905
SSDEEP

3072:M3+P+kdMT2K7D6zdm2hypiPQe4sY7qyfU3Be463m5F5wOyfU3Bl:Vy8E3m1y8l

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4196 set thread context of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3244	4196	65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\65dc1ab95be8cf374cb3f62eed84789f_JaffaCakes118.exe
  2⤵
  PID:3244

memory/3244-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3244-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3244-6-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3244-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4196-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4196-8-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download