58e5b9212bbd9449388b20b58039ece1ca599d8411fb646cd65f936775146156

Analysis

max time kernel
66s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 17:23

Target

0a32edac085da203858468d4b6ff80ab_JaffaCakes118.exe
Size

6.0MB
MD5

0a32edac085da203858468d4b6ff80ab
SHA1

05a8b4f1c1b208ded99ab82be5e1ab8c7b422567
SHA256

58e5b9212bbd9449388b20b58039ece1ca599d8411fb646cd65f936775146156
SHA512

17b7d051b4ca0ad5baf58dfa4a79c313298b5d1323b21a5b41b38be528cedcdefccf4abd05db7c1366599530463e1d0a20b4b6f4af9b857eedb410933eef5c50
SSDEEP

98304:42clMnHPnWaBZbkgr1QEia4ejgFyanLgAosPvYHddA0zWpcHCFQtVbKQKttSPvPi:4fMHPWLMQEWejgyAHvOdaGWpcrJESn2g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	116	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	0a32edac085da203858468d4b6ff80ab_JaffaCakes118.exe
116	0a32edac085da203858468d4b6ff80ab_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a32edac085da203858468d4b6ff80ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a32edac085da203858468d4b6ff80ab_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 548
  2⤵
  - Program crash
  PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 116 -ip 116
1⤵
PID:3080

memory/116-0-0x0000000001210000-0x0000000001211000-memory.dmp

Filesize
4KB

Download
memory/116-4-0x0000000000160000-0x0000000000C7D000-memory.dmp

Filesize
11.1MB

Download
memory/116-5-0x0000000000160000-0x0000000000C7D000-memory.dmp

Filesize
11.1MB

Download
memory/116-6-0x0000000000160000-0x0000000000C7D000-memory.dmp

Filesize
11.1MB

Download