a9a77c98581e0153e5feeb3e95513268e5777f3d607e200b6b6b47e945066dd5

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 17:22

Target

0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe
Size

232KB
MD5

0ee871d9a69eec4ccb90bec364411b8c
SHA1

10f0252b0a636f23bd469e38f259ef950bb89d9a
SHA256

a9a77c98581e0153e5feeb3e95513268e5777f3d607e200b6b6b47e945066dd5
SHA512

6f5d78f00e888e0b8b89e57308bb1907afcb25c0a5f9969ad3b4e240779906379618426e8dea82db349695308edb9b0f136cdcbaf45664b15ede09c688d26c56
SSDEEP

3072:0sEauiUAXx50jf5X2D4CEYrjjOFo4JIlRTc3stpYrzfoqLfOpANyr4vf8NThRpEY:f+iUAyfe4XYbOFbJkRQOQyMvf8rEY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	3744	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2656	3744	0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe	82
PID 3744 wrote to memory of 2656	3744	0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe	82
PID 3744 wrote to memory of 2656	3744	0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\0ee871d9a69eec4ccb90bec364411b8c_JaffaCakes118.exe
  X
  2⤵
  PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 276
  2⤵
  - Program crash
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3744 -ip 3744
1⤵
PID:4444

memory/3744-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download