61a222c11bf1f149ce28fa0849bb5526c18929dffaa0022810d6f8b7d4603576

Analysis

max time kernel
132s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 15:20

Target

812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe
Size

1.2MB
MD5

812e0d17286149e5b4656bc630a37074
SHA1

00267c810efad75bc9df1e954059fbf7d63b0e20
SHA256

61a222c11bf1f149ce28fa0849bb5526c18929dffaa0022810d6f8b7d4603576
SHA512

f0e3456e4cb071345b0f5f9828ab08fc078deb6cb7609291000e1bae9c607960b06a23b9b925a700cb65cefa63cf14289148ed5a8e6b5b1a1f89ddb01c1c7fc6
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mC:6MdkS6IsXkRX0bQEgYe709h4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2164	4272	WerFault.exe	82
2332	4272	WerFault.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82
PID 4232 wrote to memory of 4272	4232	812e0d17286149e5b4656bc630a37074_JaffaCakes118.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4272 -ip 4272
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4272 -ip 4272
1⤵
PID:2444

memory/4272-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-2-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-3-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-4-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-5-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4272-6-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download