19702ec0192d6f24746c6cc28ea40c46b9b6d61e96f9ce76bd485a77216f97a8

Analysis

max time kernel
129s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 18:58

Target

25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
Size

24KB
MD5

25e3cf6295dd19f542ec4912d8254622
SHA1

37c45087ccd1d2dbac0235194df24c308a709f67
SHA256

19702ec0192d6f24746c6cc28ea40c46b9b6d61e96f9ce76bd485a77216f97a8
SHA512

97ae4110db55838c391c25f596985f45d254e26f399dfec8e31701d4956698b59d2f5e3ebe7c5f024cbd7de480cfc5da607cc35e102da4aca5a1f3421764882a
SSDEEP

384:Eg5ncq9UwyGuR8DRzDYHltUzQ3bzHPnRkdfALKdkwSY0q4Cmw7UM:EgFHQHtUzQXmfALKdgBiV7B

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\skbskg.dll	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mjenpp.dll	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 940 set thread context of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	3440	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82
PID 940 wrote to memory of 3440	940	25e3cf6295dd19f542ec4912d8254622_JaffaCakes118.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3440 -ip 3440
1⤵
PID:1716

memory/940-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/940-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/940-11-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3440-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3440-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download