05bf8501436f4a220163b14d0b69540ab9163cd9da438380e93e95430b13afa1

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 04:24

Target

939d677a1670c3132f60ee21ebe8e2ba_JaffaCakes118.exe
Size

617KB
MD5

939d677a1670c3132f60ee21ebe8e2ba
SHA1

c6770a4d9bfa88625e700f5b7751deb5652b9e8d
SHA256

05bf8501436f4a220163b14d0b69540ab9163cd9da438380e93e95430b13afa1
SHA512

8871fc080202c74150ee0c58b72b3fb288fb069b6a32e0e92677f0cabfbfd1583cd4c39aa8bd15cb582c0ebcbd9f5ae4573d97fda9a5e9f1c1c3ae1d9c8f56cb
SSDEEP

12288:FsipSM2lMa4RW9Tx5J7xxLem25WBKjHhKSzDGw6mj:iipSzMa4RW9txxLJ25WBuKSzqw6s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	2040	WerFault.exe	81

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2040	939d677a1670c3132f60ee21ebe8e2ba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\939d677a1670c3132f60ee21ebe8e2ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\939d677a1670c3132f60ee21ebe8e2ba_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 520
  2⤵
  - Program crash
  PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 2040
1⤵
PID:2340

memory/2040-0-0x0000000000540000-0x000000000055F000-memory.dmp

Filesize
124KB

Download
memory/2040-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2040-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download