1ceaaba2d2392e97d4036c1358e6cd358f80a2bf22fd1947a93883052f57c52f

Analysis

max time kernel
116s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 14:00

Target

e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
Size

43KB
MD5

e2b1aa94857484432bbbd026aabfbada
SHA1

f1b44338c4ceec82767f0463fc062294eb715487
SHA256

1ceaaba2d2392e97d4036c1358e6cd358f80a2bf22fd1947a93883052f57c52f
SHA512

22c1b0a4e4dc10e1bb3b57369de059ac44d1ff1732552c63f6c71ab211ca41b34ba7b75fa6063a4905c35c068a5c655125083358136051831f96ad912fcc9f70
SSDEEP

768:vuRSNLCnC3qK6Bnz9WdnSSuJH4ZYRPpHOxsiUnJAyxz2Zkzee:vu69spSM4oJ8Uuyl2Zkz1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	1976	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 1976 wrote to memory of 4448	1976	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	96
PID 4448 wrote to memory of 3412	4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	57
PID 4448 wrote to memory of 3412	4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	57
PID 4448 wrote to memory of 3412	4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	57
PID 4448 wrote to memory of 3412	4448	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	57

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1976 -ip 1976
1⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5276 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:1600

memory/1976-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3412-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3412-7-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4448-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-5-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4448-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download