5ab22ea816ae5c44bc698122ba4ccaf39a4b92cbf86723393b1710319ae246b4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 23:07

Target

0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe
Size

13KB
MD5

0fddcdff39ca6bffb4935ff9013a36d3
SHA1

20054ea0c3681c97d949aefa01329288658332ff
SHA256

5ab22ea816ae5c44bc698122ba4ccaf39a4b92cbf86723393b1710319ae246b4
SHA512

52a64d247919aaf252c2bfd05e431afaaef823fb9311f715634646ce6a94a947a194292270f775f8cac918f84f93bd3be187abec6ad1e96d44c14b4afc00b1e6
SSDEEP

192:nMIlgn1IeV5uUuArTiHKBWDkJBGNJE1LYZfYnqrTCt7hOMCbV1TA4cemQ5:Nlgn1I4uPAr6KBWAJYAY0b7hTCHJc05

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3436	4300	0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe	87
PID 4300 wrote to memory of 3436	4300	0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe	87
PID 4300 wrote to memory of 3436	4300	0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\0fddcdff39ca6bffb4935ff9013a36d3_JaffaCakes118.exe"
  2⤵
  PID:3436

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20240625-2307.dmp
1⤵
PID:64

memory/4300-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4300-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4300-1-0x000000000040F000-0x0000000000410000-memory.dmp

Filesize
4KB

Download
memory/4300-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download