361832065150e1711cb4bf1085b8dfdafd669dfa7f063b048e853d358083efb1

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:04

Target

87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe
Size

1.4MB
MD5

87930fe078313e6f88cb3669f48ffe23
SHA1

ed42271fa2b9b9848d6f111a1e50c7deab68090c
SHA256

361832065150e1711cb4bf1085b8dfdafd669dfa7f063b048e853d358083efb1
SHA512

5f03d75d82ec04efa5090c469ed8246952b095e7e3c238f6beb51d1fbbadc97af5a7f0b14e06862210a0b854c20b4c56abe95e014deb8221925aca9412fa4e0b
SSDEEP

24576:68gP2Rq9XZbJNRg4pCz3qv4nR32WbRCbF9TgjwYhqmK1KvwVevm7IfT3GuRV:6NOkNe4OvnLCJ9Tg09mXBFf7G

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4960	2368	WerFault.exe	83
2288	2368	WerFault.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83
PID 4532 wrote to memory of 2368	4532	87930fe078313e6f88cb3669f48ffe23_JaffaCakes118.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2368 -ip 2368
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2368 -ip 2368
1⤵
PID:2320

memory/2368-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-2-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-4-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-5-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-6-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2368-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download