13d97e5d022eb5a054a066403d56e6600f48e4971a9564a3487a360761af1c00

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 15:35

Target

4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
Size

577KB
MD5

4202035ca4a4d3641b609e8ecac1115b
SHA1

ac22a582a136441a79985db2a9f8d3abe410e098
SHA256

13d97e5d022eb5a054a066403d56e6600f48e4971a9564a3487a360761af1c00
SHA512

ef1d15651a16be58f9abf043336acd61c4bb6b24aa8834edeb25d7693e2764cb2cd59b08b0c9318b56d8fea9cd8aaaa5f68dc8466906b4a59f36242b85a79288
SSDEEP

12288:Y01wk7W9EA5ISGjMgWSUro3tOQ9gFoh3vc:j1l7W9EA5IlYgzzdV9gB

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2168	4460	WerFault.exe	80
2704	3616	WerFault.exe	89
4500	1744	WerFault.exe	90

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3616	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	89
PID 4460 wrote to memory of 3616	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	89
PID 4460 wrote to memory of 3616	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	89
PID 4460 wrote to memory of 1744	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	90
PID 4460 wrote to memory of 1744	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	90
PID 4460 wrote to memory of 1744	4460	4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 536
  2⤵
  - Program crash
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 508
    3⤵
    - Program crash
    PID:2704
- C:\Users\Admin\AppData\Local\Temp\4202035ca4a4d3641b609e8ecac1115b_JaffaCakes118.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 408
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4460 -ip 4460
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3616 -ip 3616
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1744 -ip 1744
1⤵
PID:2472

memory/1744-5-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1744-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1744-9-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3616-4-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3616-6-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3616-8-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4460-0-0x00000000005B0000-0x00000000005CF000-memory.dmp

Filesize
124KB

Download
memory/4460-1-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4460-3-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download