e091ae9ac7ebd25b58b5f6dab08e16a4561a32b8eb03359e103084a75b859425

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:24

Target

2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
Size

83KB
MD5

2cb094928ed3520f39140e53b6e5c314
SHA1

8ac4402b821e0767b2933ffa5954c068e595ee30
SHA256

e091ae9ac7ebd25b58b5f6dab08e16a4561a32b8eb03359e103084a75b859425
SHA512

92b7aa93802b3bcbaf7b5e64962853ee5f877abcfa5fb0b5222cee74e929a1c6d13aa29f1d4508c9c537dfa0b5865b08f92aa6094642014929d807f80dc51e00
SSDEEP

1536:4YuHgH/+8YcM7zqt+MYvBUGbt4JtDRLCyB6E06LigZ5zofcAq/bVw0IwP:nHZrsut+DBLt43RA6VTjDNI8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	1816	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1816	752	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	80
PID 752 wrote to memory of 1816	752	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	80
PID 752 wrote to memory of 1816	752	2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2cb094928ed3520f39140e53b6e5c314_JaffaCakes118.exe"
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 12
    3⤵
    - Program crash
    PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1816 -ip 1816
1⤵
PID:1504

memory/752-0-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download