5845e1771834bae75e066dd8c7a5bb0b6aa75b0c22ac1510d1f0f5e6bb0f4c61

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 07:32

Target

124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
Size

1.4MB
MD5

124eb53ac8f662cc12ca16d1ceac17a1
SHA1

11043701857eb1cfdf0573514d0cfe787703d908
SHA256

5845e1771834bae75e066dd8c7a5bb0b6aa75b0c22ac1510d1f0f5e6bb0f4c61
SHA512

1923cbb58500997139a1dc3471715f0ee246ce3cacc113a1cd1f537ef3e2397cb3a0de407b5052dece55ac1924cc12ee70c00309dfcdfbd2526f410487ffb68f
SSDEEP

24576:Ppw0w554LBjvr4tZtA4z8qCifYqPUEgds:W0w554NjMtZtLdgqPIds

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1656	1620	WerFault.exe	80
1608	3016	WerFault.exe	79
4296	1620	WerFault.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80
PID 3016 wrote to memory of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80
PID 3016 wrote to memory of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80
PID 3016 wrote to memory of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80
PID 3016 wrote to memory of 1620	3016	124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\124eb53ac8f662cc12ca16d1ceac17a1_JaffaCakes118.exe
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 184
    3⤵
    - Program crash
    PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 188
    3⤵
    - Program crash
    PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 288
  2⤵
  - Program crash
  PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3016 -ip 3016
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1620 -ip 1620
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1620 -ip 1620
1⤵
PID:632

memory/1620-4-0x0000000013140000-0x000000001329C000-memory.dmp

Filesize
1.4MB

Download
memory/1620-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/1620-6-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/3016-0-0x0000000013140000-0x000000001329C000-memory.dmp

Filesize
1.4MB

Download
memory/3016-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3016-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3016-5-0x0000000013140000-0x000000001329C000-memory.dmp

Filesize
1.4MB

Download