e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 21:48

Target

fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe
Size

253KB
MD5

fdb8b9c8056a552461e493d3f1b4b2d8
SHA1

87ea5998b4f6831c99bdce8cd48d3c238833d2c7
SHA256

e33f9dbf56b2850d44ff3f6dff7b0631abbc52836b97cc41c4e4907538ed749a
SHA512

59217111d51a555867dac4df8e3e609706d671d1802f8c70daad3f913965dcb10cca6d878a3963e1aff7527628c7392de6b95fbf72564227a1d0b8ddea99a1b9
SSDEEP

6144:bd53TvpHeIl0SQCoocCvKrcIxJYAsXfpuUVbbNGw411hwpXHRqjoEt60R0bAM:bd53TvpHeIl0SVoA83YAAuUV/AHhQgPu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 3560 WerFault.exe fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe

pid	pid_target	process	target process
2184	3560	WerFault.exe	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe

description	pid	process	target process
PID 3560 wrote to memory of 2892	3560	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe
PID 3560 wrote to memory of 2892	3560	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe
PID 3560 wrote to memory of 2892	3560	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe	fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdb8b9c8056a552461e493d3f1b4b2d8_JaffaCakes118.exe"
2⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 356
2⤵
- Program crash
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3560 -ip 3560
1⤵
PID:4756

memory/3560-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3560-2-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download