36e3961bbec2073ec4c65a353d8f66bc7394fa76a2699464140050c8db24b7a9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 08:54

Target

78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe
Size

1.1MB
MD5

78981785f9f99fd280892e4df6b825c2
SHA1

66fe6cf7e74dc665e27e37ea8ea9873ff4c60339
SHA256

36e3961bbec2073ec4c65a353d8f66bc7394fa76a2699464140050c8db24b7a9
SHA512

e9e5de8a448a8f1e323c79d27d5350338f82bb8deaceceb5e7a864f564cf0ddd5b85872adcebf54caaa3c5e3602ab5ab044b499c1ae8a532ba06ce947591c2c4
SSDEEP

24576:iio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5sE:k4TzJJm9R9kFTSbNtkwo+5Vrle5R

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81

Program crash 2 IoCs

pid	pid_target	Process	procid_target
212	3692	WerFault.exe	81
4120	3692	WerFault.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81
PID 2384 wrote to memory of 3692	2384	78981785f9f99fd280892e4df6b825c2_JaffaCakes118.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3692 -ip 3692
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3692 -ip 3692
1⤵
PID:2192

memory/3692-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-2-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-4-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-5-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-6-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/3692-10-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download