08cb141d1e7cf2ed0ab5cad7d3f6c0edff3e3f130c9830c8c2fcadb31db07546

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:38

Target

63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
Size

1.2MB
MD5

63fe20f8dfc39087eb13631b33021b5c
SHA1

9ed6be331bae947dba8ead3851c9e19bfd9cb5ba
SHA256

08cb141d1e7cf2ed0ab5cad7d3f6c0edff3e3f130c9830c8c2fcadb31db07546
SHA512

f6fceff4ec97cf5995ff781d703b3f01acaaa798ea9c21db9292e8b1e6b6fe71077cf035f6d19f6c67bdb57bdf3bc4f34190edfbf56fbaaff6a9cefabda686cd
SSDEEP

24576:7AGDeJQ0CY1T9/ZUC7NfRxFpdkffH2u5pZMcsj:0XTAUPxmffHtw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

description	pid	process	target process
PID 4236 set thread context of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3096	1096	WerFault.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
2828	1096	WerFault.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

description	pid	process	target process
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
PID 4236 wrote to memory of 1096	4236	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe	63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63fe20f8dfc39087eb13631b33021b5c_JaffaCakes118.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1976
3⤵
- Program crash
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1936
3⤵
- Program crash
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1096 -ip 1096
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1096 -ip 1096
1⤵
PID:4028

memory/1096-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-1-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-2-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-4-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-5-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-6-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1096-10-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download