9d68602b7cf62f39b31d99a7928bf8b2adfe59d4c35e0c890d7abbfc8698fb51

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 09:20

Target
f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe
Size 113KB
Sample240416-las8yaec43
SHA256 9d68602b7cf62f39b31d99a7928bf8b2adfe59d4c35e0c890d7abbfc8698fb51
MD5 f32c44174becbadb62a3a6975c794a5c
SHA1 e5b3febd2c2c248daf662689a359c3e05e1e6a9f
SHA512 5c733b33657d475031511f8539533814a555aacad573767dc617a1e8dba481c7bd92d4dc0495952916923539b835ede2b247f529d341f709f737b6e0d4006edd
SSDEEP 3072:rtVIyDVtphMYv6wwBzRhZwGzlGBSmpKUJ7mEopip4GrF1Q8:EyDV96woZwayS2bHrzZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
652	3892	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3892	f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe
3892	f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe
3892	f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe
3892	f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f32c44174becbadb62a3a6975c794a5c_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 504
  2⤵
  - Program crash
  PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3892 -ip 3892
1⤵
PID:2848

memory/3892-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3892-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/3892-2-0x0000000000400000-0x0000000000453000-memory.dmp

Download