d97844f62223f75061719f2d5cb344e49397eda8f1f29a9c2d3d05084fec38fd

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 08:32

Target

2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe
Size

51KB
MD5

2ba9a2ad0545e7e37baf949f53c8d6d2
SHA1

203b8155ce200fcbabf0df470caa022429acbcf4
SHA256

d97844f62223f75061719f2d5cb344e49397eda8f1f29a9c2d3d05084fec38fd
SHA512

abf59ecd717baecdb34b86487c1df639f492de20ed12980f11e6a27418974e0cfc6cc5c8ef74bbfd2cede4be2363591a1bfae931815dd907b18741509a050aef
SSDEEP

1536:JocHhoagfKgIO7XJHPK9muF+4yQX3Bhzs4JQ:fBiygx7ZC7F+4bv/Q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	400	WerFault.exe	85

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
400	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85
PID 5068 wrote to memory of 400	5068	2ba9a2ad0545e7e37baf949f53c8d6d2_JaffaCakes118.exe	85

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:2540

memory/400-3-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/400-2-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/400-0-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/400-1-0x0000000006890000-0x000000000689F000-memory.dmp

Filesize
60KB

Download
memory/5068-5-0x0000000000060000-0x0000000000074000-memory.dmp

Filesize
80KB

Download