2a225057a265883f618fd7f8b5cd51ad69ac5c6b9b202d4ed6a1711a37132926

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 03:00

Target

188bdd9bb325b09950887e0268a33e0a_JaffaCakes118.exe
Size

376KB
MD5

188bdd9bb325b09950887e0268a33e0a
SHA1

2f92a539da3734056a9610e788077ccc28f272b7
SHA256

2a225057a265883f618fd7f8b5cd51ad69ac5c6b9b202d4ed6a1711a37132926
SHA512

ad46d5f212abacfa2277f5ca275b327b2b9dcb6a64abc762ae119fcf7b2eadef6bf18c5a253db30b5e14e88821bec88f7cfa998d5bfb372942cac9b54e8528a8
SSDEEP

6144:PmKFTgHYwqskTdTlw46IRCuj5G6dj2Dhg4oj9RXHZDreJNhClkngRXCih3vKPoSy:VFHwqskTdm46IRCGdj2Dhgjzhebih3CR

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	188bdd9bb325b09950887e0268a33e0a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2972	violencebl

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 4444	2972	violencebl	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	4444	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4444	2972	violencebl	83
PID 2972 wrote to memory of 4444	2972	violencebl	83
PID 2972 wrote to memory of 4444	2972	violencebl	83
PID 2972 wrote to memory of 4444	2972	violencebl	83
PID 2972 wrote to memory of 4444	2972	violencebl	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 4444
1⤵
PID:3000

C:\Program Files (x86)\violencebl

Filesize
376KB

MD5
188bdd9bb325b09950887e0268a33e0a

SHA1
2f92a539da3734056a9610e788077ccc28f272b7

SHA256
2a225057a265883f618fd7f8b5cd51ad69ac5c6b9b202d4ed6a1711a37132926

SHA512
ad46d5f212abacfa2277f5ca275b327b2b9dcb6a64abc762ae119fcf7b2eadef6bf18c5a253db30b5e14e88821bec88f7cfa998d5bfb372942cac9b54e8528a8

Download Submit
memory/2972-5-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2972-7-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2972-9-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3552-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3552-1-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/3552-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4444-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download