19c06b0fe5871725c10e5b0b1c09d945d2289876a68aef6fd818e34ba5f195e2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 19:03

Target

f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe
Size

519KB
MD5

f8913afa39b5bd5229bc21253d49e81e
SHA1

c970c064e411a05caf454ddeb80c51f5fbafe573
SHA256

19c06b0fe5871725c10e5b0b1c09d945d2289876a68aef6fd818e34ba5f195e2
SHA512

58355d90d364942e21083d9c1ed74a92b46dcce824daa252afd289401d718e4733baa5e8052dd9e187ad16a81f62a3b91ba669e68041c975905bf4ca1ec111cb
SSDEEP

12288:i7mcy5bbCs0t0Eir1u2WFORMzfte/UODTQqxW9pQFglbaMz:iHKEir1aORMzFhz9iglJz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4912 2140 WerFault.exe f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe

pid	pid_target	process	target process
4912	2140	WerFault.exe	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe

description	pid	process	target process
PID 2140 wrote to memory of 4828	2140	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe
PID 2140 wrote to memory of 4828	2140	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe
PID 2140 wrote to memory of 4828	2140	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe	f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8913afa39b5bd5229bc21253d49e81e_JaffaCakes118.exe"
2⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 416
2⤵
- Program crash
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2140 -ip 2140
1⤵
PID:4996

memory/2140-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2140-1-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download