5c6bdf4277321ebade7a21872615ff93e64395c99e59c725c238881f04e56e3c

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 05:56

Target

f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe
Size

299KB
MD5

f0788b74439d4494761c8aa1c6bdd657
SHA1

98f426a0e99edbf29f41dfcb273444f4eeb4116d
SHA256

5c6bdf4277321ebade7a21872615ff93e64395c99e59c725c238881f04e56e3c
SHA512

f2e588aeb45d81cd2a0bc992d07dc4e3820276819edaaf591ea55a01f55e3a46024f69d7becba9560539001e283b99ff534df13977c60a7c68374056f7efea13
SSDEEP

6144:pjP5IphwxkeVG6fNROQh/cqtYoMqs+hYZIHN/8LKk:RP57w6ypDoBs+hY0CR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 2116 WerFault.exe f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe

pid	pid_target	process	target process
2160	2116	WerFault.exe	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe

description	pid	process	target process
PID 2116 wrote to memory of 4232	2116	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe
PID 2116 wrote to memory of 4232	2116	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe
PID 2116 wrote to memory of 4232	2116	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe	f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f0788b74439d4494761c8aa1c6bdd657_JaffaCakes118.exe"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 456
  2⤵
  - Program crash
  PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2116 -ip 2116
1⤵
PID:3736

memory/2116-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/2116-2-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download