89a1e9369a309e1ea552ac130cda8ede7639bd5b6ab2d7657af7fb1f62dc0a82

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:43

Target

05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe
Size

29KB
MD5

05ad82d8ea7bc7c500977f58b3bedd2c
SHA1

b276d0df3e0d0a33739e148c4e0e91efff06ec15
SHA256

89a1e9369a309e1ea552ac130cda8ede7639bd5b6ab2d7657af7fb1f62dc0a82
SHA512

4c6ab2317ed707022b1d5b071b8d3db92f56796b52e6ad39fd2e6f0ff6e2b03d8e61ec60fd54c2b337fd4b308169767074d24eada0b5ac0b4904898f8769f333
SSDEEP

384:h/hF0W2gMBZRxzlRmY5a8elnSymDpXcS5w76qlfsR3fItl/UXxTyl22FDloWFD8u:hoWHizqYs8ecHDRcd3UfJk2C9moPL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 428 set thread context of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	1912	WerFault.exe	82

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82
PID 428 wrote to memory of 1912	428	05ad82d8ea7bc7c500977f58b3bedd2c_JaffaCakes118.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1912 -ip 1912
1⤵
PID:4212

memory/428-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1912-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1912-2-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1912-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1912-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1912-8-0x0000000000400000-0x0000000000403600-memory.dmp

Filesize
13KB

Download