1464e03e65d329fc8698704255924de2c3fb42dcd0f25901cd85bc7d4d50248a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 05:11

Target

386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe
Size

589KB
MD5

386d9a648e5600d46548bae0a66a69e7
SHA1

6bbcba92aa988c90979d8fc682b203fdd19406f8
SHA256

1464e03e65d329fc8698704255924de2c3fb42dcd0f25901cd85bc7d4d50248a
SHA512

6f7a12b8b51e6381fd06e9dee3dcafcd4c3f0d8dedce72d49e07c89ff89cf6d0df4531d8f15bd8b17152b4a0665df5bb50aa1b2347f2a8bf28a5832cc8c3b642
SSDEEP

6144:tfc2iij7GqfY+CG78PT/j83cI6Cj2GKfA7tAKsKSrZyPd4MY41bMUzMD5qPPMEGv:tfLi25Y+z7Cw3WCj2GC64KSrZyymL9Uv

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4572	2820	WerFault.exe	83
2204	3920	WerFault.exe	92
3156	3964	WerFault.exe	91

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3964	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	91
PID 2820 wrote to memory of 3964	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	91
PID 2820 wrote to memory of 3964	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	91
PID 2820 wrote to memory of 3920	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	92
PID 2820 wrote to memory of 3920	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	92
PID 2820 wrote to memory of 3920	2820	386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 584
  2⤵
  - Program crash
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 568
    3⤵
    - Program crash
    PID:3156
- C:\Users\Admin\AppData\Local\Temp\386d9a648e5600d46548bae0a66a69e7_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 564
    3⤵
    - Program crash
    PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2820 -ip 2820
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3964 -ip 3964
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3920 -ip 3920
1⤵
PID:4508

memory/2820-0-0x0000000000620000-0x000000000063F000-memory.dmp

Filesize
124KB

Download
memory/2820-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2820-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3920-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3920-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3920-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3964-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3964-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3964-8-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download