067fd565b9f71d69f4b16d4ac1d2b0a1c41c090a194a88d3b573daf26cb4cb95

Analysis

max time kernel
67s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 05:34

Target

047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
Size

564KB
MD5

047ae3338e5226b5283930c8acada287
SHA1

3a61453c1a938d226d6b9e0b3ed8c8c0b17416f1
SHA256

067fd565b9f71d69f4b16d4ac1d2b0a1c41c090a194a88d3b573daf26cb4cb95
SHA512

cf54a569f0adbf2a4b4b7f5140d7dd06f5fa019b5a8fbc599404d7ee0f84dc713bcc7e8c762efb301ced905d0948dd077bab1526605f46d5ac675655e52ad98d
SSDEEP

12288:oeDkUkqDYViCukcCaGMxDVS5VNW59AyuaL6jCWtdP5P4BpOXDIegD:ou3cViCHnM+5aAqydPNQ

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4888	2860	WerFault.exe	83
2052	1364	WerFault.exe	92
3724	2848	WerFault.exe	91

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2848	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	91
PID 2860 wrote to memory of 2848	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	91
PID 2860 wrote to memory of 2848	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	91
PID 2860 wrote to memory of 1364	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	92
PID 2860 wrote to memory of 1364	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	92
PID 2860 wrote to memory of 1364	2860	047ae3338e5226b5283930c8acada287_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 528
  2⤵
  - Program crash
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 388
    3⤵
    - Program crash
    PID:3724
- C:\Users\Admin\AppData\Local\Temp\047ae3338e5226b5283930c8acada287_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 488
    3⤵
    - Program crash
    PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2860 -ip 2860
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1364 -ip 1364
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2848 -ip 2848
1⤵
PID:2864

memory/1364-4-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1364-5-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1364-7-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2848-6-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2860-0-0x000000007FE30000-0x000000007FE4F000-memory.dmp

Filesize
124KB

Download
memory/2860-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2860-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download