1208ce36e28cb15753f6b61fd219558430dbd934c01c1122e6665efa85f98a3b

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:05

Target

68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe
Size

755KB
MD5

68f1c2daafd585c642607fa1bd45b228
SHA1

14580070acc07faf09fd7a711c0eed80bead0c4e
SHA256

1208ce36e28cb15753f6b61fd219558430dbd934c01c1122e6665efa85f98a3b
SHA512

aa468fc9da9a5c00c99aee491c7f676bd4130726205c456f8de8529d05e8b3e410f44e25d6eee7c168f4eff8df089ec2c29c322a81a14ac6daaa9cbc3b8912e5
SSDEEP

12288:sCgTBURd2JuJQHGlwst1QB9eyGgrsa3/JhKrnqCsNaUu64xzvReZX4Kj02:sNKftOreyLernDweRiIm02

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

2212 setup.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 2212 WerFault.exe setup.exe

pid	process
2212	setup.exe

pid	pid_target	process	target process
2076	2212	WerFault.exe	setup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exesetup.exe

pid	process
4388	68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe
4388	68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe
2212	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe

description	pid	process	target process
PID 4388 wrote to memory of 2212	4388	68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe	setup.exe
PID 4388 wrote to memory of 2212	4388	68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe	setup.exe
PID 4388 wrote to memory of 2212	4388	68f1c2daafd585c642607fa1bd45b228_JaffaCakes118.exe	setup.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 768
3⤵
- Program crash
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2212 -ip 2212
1⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
755KB

MD5
68f1c2daafd585c642607fa1bd45b228

SHA1
14580070acc07faf09fd7a711c0eed80bead0c4e

SHA256
1208ce36e28cb15753f6b61fd219558430dbd934c01c1122e6665efa85f98a3b

SHA512
aa468fc9da9a5c00c99aee491c7f676bd4130726205c456f8de8529d05e8b3e410f44e25d6eee7c168f4eff8df089ec2c29c322a81a14ac6daaa9cbc3b8912e5

Download Submit
memory/2212-8-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/2212-9-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/2212-11-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4388-1-0x000000000065C000-0x000000000065D000-memory.dmp

Filesize
4KB

Download
memory/4388-0-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4388-7-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download