2783f4ef31d770285c15b71ecb69e54d0a99aec4ef47564edc053a9b801f03ba

Analysis

max time kernel
126s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:19

Target

280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe
Size

1.1MB
MD5

280e037fafc6ac46eed28d5fd801e597
SHA1

42a3d4b707c090e70b48e44552b36596207aab31
SHA256

2783f4ef31d770285c15b71ecb69e54d0a99aec4ef47564edc053a9b801f03ba
SHA512

a1dc61860e31596eda442d3cc2875f494d29e20686d5e2d9f417a165b374415e6c21b63f094bd04492dec186422ffebb58316f94b4fc445b4b5489b5abae1e17
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5su:U4TzJJm9R9kFTSbNtkwo+5Vrle5f

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5108 set thread context of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3724	64	WerFault.exe	88
4840	64	WerFault.exe	88

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
64	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe
64	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe
64	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe
64	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe
64	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88
PID 5108 wrote to memory of 64	5108	280e037fafc6ac46eed28d5fd801e597_JaffaCakes118.exe	88

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 64
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 64 -ip 64
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1276,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:2656

memory/64-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-2-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-3-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-4-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-5-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/64-9-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download