5845e1771834bae75e066dd8c7a5bb0b6aa75b0c22ac1510d1f0f5e6bb0f4c61

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 07:32

Target

124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
Size

1.4MB
MD5

124eb53ac8f662cc12ca16d1ceac17a1
SHA1

11043701857eb1cfdf0573514d0cfe787703d908
SHA256

5845e1771834bae75e066dd8c7a5bb0b6aa75b0c22ac1510d1f0f5e6bb0f4c61
SHA512

1923cbb58500997139a1dc3471715f0ee246ce3cacc113a1cd1f537ef3e2397cb3a0de407b5052dece55ac1924cc12ee70c00309dfcdfbd2526f410487ffb68f
SSDEEP

24576:Ppw0w554LBjvr4tZtA4z8qCifYqPUEgds:W0w554NjMtZtLdgqPIds

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2284	2244	WerFault.exe	27
2832	1916	WerFault.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1916	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	28
PID 1916 wrote to memory of 2832	1916	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2832	1916	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2832	1916	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2832	1916	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2284	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2284	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2284	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2284	2244	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 36
    3⤵
    - Program crash
    PID:2832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 92
  2⤵
  - Program crash
  PID:2284

memory/1916-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1916-8-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1916-5-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1916-11-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2244-0-0x0000000013140000-0x000000001329C000-memory.dmp

Filesize
1.4MB

Download
memory/2244-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2244-9-0x0000000001C70000-0x0000000001DCC000-memory.dmp

Filesize
1.4MB

Download
memory/2244-10-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2244-12-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000013140000-0x000000001329C000-memory.dmp

Filesize
1.4MB

Download
memory/2244-14-0x0000000001C70000-0x0000000001DCC000-memory.dmp

Filesize
1.4MB

Download