24c74813391a387f6381ae6d3aec7c94f8e3bd2979082af5fcca43c66847ded1

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 20:18

Target

42e646a9ce9731d6eafa1a6fc40e122d_JaffaCakes118.exe
Size

617KB
MD5

42e646a9ce9731d6eafa1a6fc40e122d
SHA1

6c4f50cebc0280874aba0c626a078fac3251336c
SHA256

24c74813391a387f6381ae6d3aec7c94f8e3bd2979082af5fcca43c66847ded1
SHA512

ed3a4a50d45563bbf7d65e2a382d1b7e1d080f66bcb54496bb181794c0d460095d8d309c12ecc71a9983fbe5614de98374d81e96a88c21d71a361f3aa84ff879
SSDEEP

12288:qpjsuusDn9vgyag/hj9UrjvY4BnRLb8GBcGMdK:aouFn94vgJj9UfYMR8GiK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	1112	WerFault.exe	81

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1112	42e646a9ce9731d6eafa1a6fc40e122d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\42e646a9ce9731d6eafa1a6fc40e122d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42e646a9ce9731d6eafa1a6fc40e122d_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 572
  2⤵
  - Program crash
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1112 -ip 1112
1⤵
PID:2604

memory/1112-0-0x0000000000610000-0x000000000062F000-memory.dmp

Filesize
124KB

Download
memory/1112-1-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1112-2-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download