2135550530f048bbb061e33498c38808213b0a6504b5e317090d9b67844de009

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:14

Target

687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe
Size

755KB
MD5

687af4f35948aaab34f674b1ca5ab150
SHA1

88de84c569823351d6e1ffc21ba6700f0a955d1a
SHA256

2135550530f048bbb061e33498c38808213b0a6504b5e317090d9b67844de009
SHA512

f0a13836c80f3c9d82172aec1109d05c845b7ecaf837d458eb8bb1eb3f005886b91a6ebfefe938b71086c4f7649ddacd1d0f5423d0722dc8998ebe4eac5d7ab9
SSDEEP

12288:aQN20eCofhgVDNuK40ufbN64b6slOJ5B/N2j+aFUnQn53CI2tjyufeKrn:x40eCoJgD8H3T04nARN2H6nQn53lQjyS

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

setup.exe

pid process

4152 setup.exe
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3868 4152 WerFault.exe setup.exe
4276 4152 WerFault.exe setup.exe
1348 4152 WerFault.exe setup.exe

pid	process
4152	setup.exe

pid	pid_target	process	target process
3868	4152	WerFault.exe	setup.exe
4276	4152	WerFault.exe	setup.exe
1348	4152	WerFault.exe	setup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exesetup.exe

pid	process
2344	687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe
2344	687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe
4152	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe

description	pid	process	target process
PID 2344 wrote to memory of 4152	2344	687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe	setup.exe
PID 2344 wrote to memory of 4152	2344	687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe	setup.exe
PID 2344 wrote to memory of 4152	2344	687af4f35948aaab34f674b1ca5ab150_JaffaCakes118.exe	setup.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4152 -ip 4152
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4152 -ip 4152
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4152 -ip 4152
1⤵
PID:116

C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
755KB

MD5
687af4f35948aaab34f674b1ca5ab150

SHA1
88de84c569823351d6e1ffc21ba6700f0a955d1a

SHA256
2135550530f048bbb061e33498c38808213b0a6504b5e317090d9b67844de009

SHA512
f0a13836c80f3c9d82172aec1109d05c845b7ecaf837d458eb8bb1eb3f005886b91a6ebfefe938b71086c4f7649ddacd1d0f5423d0722dc8998ebe4eac5d7ab9

Download Submit
memory/2344-0-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/2344-1-0x000000000065C000-0x000000000065D000-memory.dmp

Filesize
4KB

Download
memory/2344-7-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4152-8-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4152-13-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4152-17-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/4152-23-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download