c1d526e5fb30ef81d755c3c99fe8a6fed3c0a969c52d25a1d799bd6440cf5541

Analysis

max time kernel
51s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 05:17

Target

03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
Size

20KB
MD5

03213606b154cdf27ef999b3f0be54ae
SHA1

df28364d1ec8a9e314c0a7a29eec33692f397f82
SHA256

c1d526e5fb30ef81d755c3c99fe8a6fed3c0a969c52d25a1d799bd6440cf5541
SHA512

f469dfd766d909c32a257b75ea934c8314955cce12705f26e7709dea048c9443dc745d03a1aeb6a552fab32c9995cf94b182fd9f3c3fa0a8e0c00a0373447772
SSDEEP

384:IXwWtsW4cCoAkQMr7Pd5QlS8J5U3255Tiv0D1GCBTlHpfxPjK:CyoHQMnVqlVHUG55TicD1GCnHpfE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\imgvew.com	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
File created	C:\Program Files\Common Files\imgvew.com	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1000	4540	WerFault.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 4540	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	81
PID 4136 wrote to memory of 2536	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	82
PID 4136 wrote to memory of 2536	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	82
PID 4136 wrote to memory of 2536	4136	03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 12
    3⤵
    - Program crash
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\03213606b154cdf27ef999b3f0be54ae_JaffaCakes118.exe"
  2⤵
  PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4540 -ip 4540
1⤵
PID:1088

memory/4136-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4136-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4540-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4540-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download