2cfad80b48ead20a58614c9c111e7064eadc00e5a0f1753de5b1c4a2afb9f3f1

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 19:48

Target

ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe
Size

675KB
MD5

ebdb4464103b5c7827c67bc5cb854c9e
SHA1

6ec7bbfe8fa3c295e672e00e3c71fa115650a9b9
SHA256

2cfad80b48ead20a58614c9c111e7064eadc00e5a0f1753de5b1c4a2afb9f3f1
SHA512

0e576964adce2434a64d31f6953bb2ac540bb8c323de4a304db1ccd75a03c16957df355f6621f979cae30dc4396197fc7c3ee0ec16ff6241646f1f48a71a5aba
SSDEEP

12288:uf63OmNpfnBouDQEj5LMBc3hQO2/ZukVKTwJXXjVx+hzaLGJvIAYgZxo9p:c6+mXBomVLMBrXFKTwFjV0V6cQh0Ap

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	4980	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3056	4980	ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe	86
PID 4980 wrote to memory of 3056	4980	ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe	86
PID 4980 wrote to memory of 3056	4980	ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ebdb4464103b5c7827c67bc5cb854c9e_JaffaCakes118.exe
  2⤵
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 496
  2⤵
  - Program crash
  PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:3932

memory/4980-0-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download