9f831e9bfb119196a397daf7a20e88c1a4b6fedea30f480e790e1949053b01bf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 06:13

Target

029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe
Size

280KB
MD5

029ba195c7ee484f1d9e890cb53c3253
SHA1

0f70c95f5fbb79bd5706fa95c50f6396d4a5287f
SHA256

9f831e9bfb119196a397daf7a20e88c1a4b6fedea30f480e790e1949053b01bf
SHA512

6cc099fa017d5be11f90a5038deb05bc4df9e0347255264ecb74fdbcdb10b8d592eeefc9effadc84997fa3cf66f21537ce9ddf1208731846386ce0a75603a32b
SSDEEP

3072:88B9eGRGf/lHy2xlP9xlISMxyNNjs5dfI85oBhmAjSuHauBFdCL+m7YniIHUlgi:88B8Ny2bP9xlIPFzfI85oTmAGuHlqCd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

description	pid	process	target process
PID 3328 set thread context of 5068	3328	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 5068 WerFault.exe 029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

pid	pid_target	process	target process
1256	5068	WerFault.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

description	pid	process	target process
PID 3328 wrote to memory of 5068	3328	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe
PID 3328 wrote to memory of 5068	3328	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe
PID 3328 wrote to memory of 5068	3328	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe
PID 3328 wrote to memory of 5068	3328	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe	029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\029ba195c7ee484f1d9e890cb53c3253_JaffaCakes118.exe"
2⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 80
3⤵
- Program crash
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5068 -ip 5068
1⤵
PID:2244

memory/3328-0-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/3328-1-0x00000000018B0000-0x00000000018C0000-memory.dmp

Filesize
64KB

Download
memory/3328-2-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/3328-4-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/3328-6-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download