a9a99344c85b1cd3e786ad96610e9e71406828508e8c9c3aba7e61599f8133c5

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 04:46

Target

3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe
Size

55KB
MD5

3c06ac4e399c8917a7d1a20f46e3405b
SHA1

c9d4bb28a95527789c722e14c11cf38b5638f20b
SHA256

a9a99344c85b1cd3e786ad96610e9e71406828508e8c9c3aba7e61599f8133c5
SHA512

be6c8869718580a3ae0641db30a3cf25ee38cb090ae544912c8e0197ea7d86b1725d939b95290867fc005d4da2372aa2f5f345a17ec0869cffcd7ce8687dd2bb
SSDEEP

768:0I07zy0IQ5XXn/pp0RdceBi4d3IalnPZk/Rpd1JCmXrz4UwtlWhwlpdtgY3AGkPl:0Is9IcH/gRmeBi4JdkpgGhj+pgykPl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4484 set thread context of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	4484	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4484 wrote to memory of 4412	4484	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	89
PID 4412 wrote to memory of 3416	4412	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	56
PID 4412 wrote to memory of 3416	4412	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	56
PID 4412 wrote to memory of 3416	4412	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	56
PID 4412 wrote to memory of 3416	4412	3c06ac4e399c8917a7d1a20f46e3405b_JaffaCakes118.exe	56

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
1⤵
PID:4240

memory/3416-5-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3416-6-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4412-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4412-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4412-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4412-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download