136ac86cafd385da40c3e1a1464cf03d66d40bc58448e99ea2f73ce6659a95d6

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 07:53

Target

5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe
Size

1.2MB
MD5

5df61cbb5d5295d3520ea20e8038304e
SHA1

df767296bfc79e80d4a78def5ad175b2dc3b50d5
SHA256

136ac86cafd385da40c3e1a1464cf03d66d40bc58448e99ea2f73ce6659a95d6
SHA512

e650564cf6c466e945d3b2f83412bfc9d4d52f73f9576d817d20678693964f9d3a1bb3f7f0c5858791bc876c4f1fdedac7538ef2fa689c8aaff80194cfda3ad6
SSDEEP

24576:FZY4EpQIEg5e3Fo/pJjmEv6sp7rep0uKUYx:FIryKLjmEvZSpUt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1176	2372	WerFault.exe	83
3092	2372	WerFault.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83
PID 1020 wrote to memory of 2372	1020	5df61cbb5d5295d3520ea20e8038304e_JaffaCakes118.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2372 -ip 2372
1⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2372 -ip 2372
1⤵
PID:2224

memory/2372-0-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-1-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-2-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-4-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-5-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-6-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2372-10-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download