58f19209af5aed45ad87edc6975a575d48a7f8912faa474c30310d3ca0d220d6

Analysis

max time kernel
129s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:46

Target

1610077f1d8418a138b630f67be4d45f_JaffaCakes118.exe
Size

10KB
MD5

1610077f1d8418a138b630f67be4d45f
SHA1

fb7852033cd57f88ab6a36f3332e08ea808563b2
SHA256

58f19209af5aed45ad87edc6975a575d48a7f8912faa474c30310d3ca0d220d6
SHA512

bbbd8e37cc7c8acf04b77e931c76cfb4fcbc35680b055a2e20a71b43df95a001267723a52f6656a77ba74f237e8bb0e3fc168d4723e9b4ff5302da5974b93a6d
SSDEEP

192:mOm/OjAbksOz9Ghnjs6buO3EeAT8YLW/8AoWE:mDbktqnlaW/8AoW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
740	2220	WerFault.exe	81

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 536	2220	1610077f1d8418a138b630f67be4d45f_JaffaCakes118.exe	82
PID 2220 wrote to memory of 536	2220	1610077f1d8418a138b630f67be4d45f_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\1610077f1d8418a138b630f67be4d45f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1610077f1d8418a138b630f67be4d45f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Modifies registry class
  PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 272
  2⤵
  - Program crash
  PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2220 -ip 2220
1⤵
PID:4344