34dc65e6c547cdb3d6b26a9050b0890de35450ef08fcee6f28b1a3addcd98b98

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 09:04

Target

04909a3369ec622063876d16158e1405_JaffaCakes118.exe
Size

26KB
MD5

04909a3369ec622063876d16158e1405
SHA1

c192f211fd626f27bfda82ae151be10a812a2766
SHA256

34dc65e6c547cdb3d6b26a9050b0890de35450ef08fcee6f28b1a3addcd98b98
SHA512

808e453b24786e11615d7b2fe469c317da12290fa337fd2e78cae6031b61acf994c39c76d6ace537abbb476a297e98653c6373a114ff54c24d974a21eb7c5c91
SSDEEP

768:7WxmEWXAsz5XdN17mypdHyRk+WVus+PQZT1bg:e1W1TN5mm+musQ

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2524	04909a3369ec622063876d16158e1405_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windhcp.ocx	04909a3369ec622063876d16158e1405_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windhcp.ocx	04909a3369ec622063876d16158e1405_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	2524	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	04909a3369ec622063876d16158e1405_JaffaCakes118.exe
2524	04909a3369ec622063876d16158e1405_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04909a3369ec622063876d16158e1405_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04909a3369ec622063876d16158e1405_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 324
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\04909a3369ec622063876d16158e1405_JaffaCakes118.dat

Filesize
22KB

MD5
d1f0a978f06ce11f36c1d4a507717e2e

SHA1
06cdf189e4c6f2ce8de9d39534ded678bc2efe77

SHA256
02a0d99d07bef1f68186a472b50162b31215eb793ab21152155b094155e822a8

SHA512
f813de22c3276b37969a142477a7bd5b633c8781f694066a61a6fbb20bbf7ca6aee5fe81b14dc0809eda3a9fbecb5ff9e878b986f80c36235eff2d30d3200f76

Download Submit
memory/2524-6-0x00000000004D0000-0x00000000004D2000-memory.dmp

Filesize
8KB

Download
memory/2524-4-0x0000000010090000-0x00000000100A2000-memory.dmp

Filesize
72KB

Download
memory/2524-11-0x0000000010090000-0x00000000100A2000-memory.dmp

Filesize
72KB

Download