0d18f8bea56886ffab166c8c1be5512e6c4117690168ac171e0e5e81ab581793

Analysis

max time kernel
141s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 13:46

Target

a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe
Size

8.6MB
MD5

a9fec227c4cf4113a70e7d812811c6a6
SHA1

1bbad2c2ec6f917f7e7d7b0ca5ca452d4b6ed3e4
SHA256

0d18f8bea56886ffab166c8c1be5512e6c4117690168ac171e0e5e81ab581793
SHA512

9f0fd6888d1d27a793333c9d9f0e3d1fed717ba1ed31fd65983253b17a70c0b3abed1858263d1527f70609c1b68ebb05ea9b34d9aa840275f5ec754006e865cf
SSDEEP

98304:q3WIosGshkzIJYHKvbruN6Q6BYCmA5RnEqgHUGtln1dZaoKAvtsGiZq2T:qcsGshXcgOTD1/aoK4wZq2T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
732	3404	WerFault.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3404	a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe
3404	a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1736	3404	a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe	83
PID 3404 wrote to memory of 1736	3404	a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9fec227c4cf4113a70e7d812811c6a6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1528
  2⤵
  - Program crash
  PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:1968

memory/3404-0-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3404-1-0x0000000000400000-0x0000000000C15000-memory.dmp

Filesize
8.1MB

Download
memory/3404-3-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download