0564c9a0ccc3d5f9c61fe6f55171eae39a911fe07beea3891cc5581b3dee2d70

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 18:26

Target

8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe
Size

1.6MB
MD5

8eff754a4a74e12696207fa1628ca728
SHA1

673b84ec396783b0478acad28c127eeeca4fbb30
SHA256

0564c9a0ccc3d5f9c61fe6f55171eae39a911fe07beea3891cc5581b3dee2d70
SHA512

65485da0cea9c2e3ef373df90dd79e4f52df95b9d0d8e6b9ffdd52d2aa3156c587c085fc9c83f137fa237801e8f00f0c1d953b577b4271132467c9970142d56e
SSDEEP

24576:+zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYw:m6/ye0PIphrp9Zuvjqa0UidL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3616	3280	WerFault.exe	82
2476	3280	WerFault.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82
PID 2152 wrote to memory of 3280	2152	8eff754a4a74e12696207fa1628ca728_JaffaCakes118.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3280 -ip 3280
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3280 -ip 3280
1⤵
PID:4216

memory/3280-0-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-1-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-2-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-3-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-4-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-5-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-6-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3280-10-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download