7d51658c5052c574d33ae1adada2f3c66025dc48d520068f715bcd35a57460fd

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 13:29

Target

34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe
Size

4KB
MD5

34eb1848aeae62e565074fd1b1dc82d4
SHA1

e6a0c73769c904159d772d4e94b302874d99fd84
SHA256

7d51658c5052c574d33ae1adada2f3c66025dc48d520068f715bcd35a57460fd
SHA512

f35e2c000ce40a078e5cb434cd44accfc226a6cd391fcabeed7cfb245850641f75ff5cbf5aafb5866262c9637cdd203795fa9eecbc46c13531fef760402f109c
SSDEEP

96:68a18STQaii7/pobsWGyq2IlmST99+3/fBAlkm/Ar:GLTXi8BFX2W5TD+vfBAb/A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3360	2424	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2512	2424	34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe	82
PID 2424 wrote to memory of 2512	2424	34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe	82
PID 2424 wrote to memory of 2512	2424	34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34eb1848aeae62e565074fd1b1dc82d4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\DelUS.bat
  2⤵
  PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 276
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2424 -ip 2424
1⤵
PID:792

C:\Users\Admin\AppData\Local\Temp\DelUS.bat

Filesize
305B

MD5
eb5885c814c7e14ca9af9a0e18fbd3ad

SHA1
2bf6d8c1dac665e46ddb4103e8b905b9b7b7721a

SHA256
26e188b1761dd2fcad9e0b7567ee1f3f4610cb7b42350ad1b9d258bc7fca4e7f

SHA512
d2417446a6f7de13f9ebe3e27acd97d0dafc77d682b0d111db763d30dc2690bb3de045a7dcfc465f402aecd9913f5c84acd68bf42c7999490ca80bce01e09979

Download Submit
memory/2424-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2424-5-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download