8c7a53c895aa1223a5dfde8ead365d9cbb4e8b868e81fbe9c52c3d203c5e1dba

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 20:19

Target

51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe
Size

1.2MB
MD5

51507a0c76ccc002ad56782192d5257a
SHA1

bd38cc47586688595625f85f6a09e48a2c06287c
SHA256

8c7a53c895aa1223a5dfde8ead365d9cbb4e8b868e81fbe9c52c3d203c5e1dba
SHA512

60d01558d5cb56cdd39a27d6f1dde3860fd51932cad1ca453194863cb25626d90f6ee0602efc900d55ead28a16d9130716a6605cb55d579ad1ae0f847960a354
SSDEEP

24576:6tb20pkaCqT5TBWgNQ7aGnTSxiQyCNOnck6A:nVg5tQ7aGSiQyC65

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe

description pid process target process

PID 2968 set thread context of 740 2968 51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 740 WerFault.exe WerFault.exe

description	pid	process	target process
PID 2968 set thread context of 740	2968	51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe	WerFault.exe

pid	pid_target	process	target process
1632	740	WerFault.exe	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe

description	pid	process	target process
PID 2968 wrote to memory of 740	2968	51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe	WerFault.exe
PID 2968 wrote to memory of 740	2968	51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe	WerFault.exe
PID 2968 wrote to memory of 740	2968	51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe	WerFault.exe
PID 2968 wrote to memory of 740	2968	51507a0c76ccc002ad56782192d5257a_JaffaCakes118.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 740 -ip 740
1⤵
PID:2060

C:\Users\Admin\AppData\Local\Temp\aut3DF3.tmp

Filesize
167KB

MD5
a8f6f8cbc242432f29dd9cdd4fad31da

SHA1
b88d52b9e486ee8794b47028c2dda040e2af06fd

SHA256
cff694c17eb7be042516dd58d20baa5d48b48f6a7a05ec20589ac0603afe1d94

SHA512
b5aaa36d621a5eec0dab5c6d01dc57d4909557595c6bbc23864ea30eac343198bfb40ebf83994b12600ee1a3a9a42dd73cbf316c537a9637894db981df42ed93

Download Submit