7b6b1e86c0de2efda1666b58fa7d43bc0eac2914f5f3eb19bc82c845e5a53b10

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 13:11

Target

064ab238296459379ae09891e3063b15_JaffaCakes118.exe
Size

86KB
MD5

064ab238296459379ae09891e3063b15
SHA1

09851256ed8a8bf927551416ef847fff8ddc49f9
SHA256

7b6b1e86c0de2efda1666b58fa7d43bc0eac2914f5f3eb19bc82c845e5a53b10
SHA512

42a4ecf100cf4bb502c90c9ec0ae1847167517baaf2c3efb854fc96127461cb459199ebcc035150da646b269a91a78c7ae61e749c7673e13958e24f2fcb051a6
SSDEEP

1536:MBjslXVB1WRydFMQacilWJ6VY0iEbOasbO4Wx4RcRqDRoQU8+FTXe4oTTtE18fNt:MBEn6QRoQUHXe4oTTtvNio/YU+2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3964 set thread context of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4152	3964	WerFault.exe	80
1888	812	WerFault.exe	81

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81
PID 3964 wrote to memory of 812	3964	064ab238296459379ae09891e3063b15_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\064ab238296459379ae09891e3063b15_JaffaCakes118.exe"
  2⤵
  PID:812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 12
    3⤵
    - Program crash
    PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 320
  2⤵
  - Program crash
  PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 812 -ip 812
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3964 -ip 3964
1⤵
PID:4432

memory/812-1-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/812-0-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/3964-3-0x0000000019140000-0x000000001915B73C-memory.dmp

Filesize
109KB

Download