91bc78538798e0384f10a5ab90841d77f7a01341c9c6eb642beadb9789ed88d3

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:11

Target

07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
Size

360KB
MD5

07257b0d004ba9db73a6ba6538121cfd
SHA1

4ae2320ea56954fd66c98cf0cf4f0d95107063e8
SHA256

91bc78538798e0384f10a5ab90841d77f7a01341c9c6eb642beadb9789ed88d3
SHA512

2f7835f058c28670f7dc486d97fdc60650c4beb6ccf46c5c52cb4648ea7cc627009c85c6b25512ed39bbc5169bc7c020bc71eb0b0123bdb7d5f289471b394364
SSDEEP

6144:Vub9vidSyd/8wKko6y2vYMRpqSWqziVGQIbu3Cnd+vOCpYgfKAnzHwzSZAxJoS:e96dSymkdBvYMmSWhVoFnd+mCqg9Ibxz

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4020	Alertere.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	1304	WerFault.exe	94

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 1304	4020	Alertere.exe	94

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Alertere.exe	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe
4504	07257b0d004ba9db73a6ba6538121cfd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1304	4020	Alertere.exe	94
PID 4020 wrote to memory of 1304	4020	Alertere.exe	94
PID 4020 wrote to memory of 1304	4020	Alertere.exe	94
PID 4020 wrote to memory of 1304	4020	Alertere.exe	94
PID 4020 wrote to memory of 1304	4020	Alertere.exe	94

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1304 -ip 1304
1⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:8
1⤵
PID:4080

C:\Windows\Alertere.exe

Filesize
360KB

MD5
07257b0d004ba9db73a6ba6538121cfd

SHA1
4ae2320ea56954fd66c98cf0cf4f0d95107063e8

SHA256
91bc78538798e0384f10a5ab90841d77f7a01341c9c6eb642beadb9789ed88d3

SHA512
2f7835f058c28670f7dc486d97fdc60650c4beb6ccf46c5c52cb4648ea7cc627009c85c6b25512ed39bbc5169bc7c020bc71eb0b0123bdb7d5f289471b394364

Download Submit
memory/1304-11-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4020-8-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/4020-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4020-12-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4504-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4504-1-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/4504-10-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download