1fc780c4864c6b00e2bbabed30a67f5b4cca78fc42f39392e770c72d5b2031be

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 10:29

Target

3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
Size

127KB
MD5

3d02226b31f4f46e5685391c00f35ffc
SHA1

cf5a807f372da6ff3eb714eb7739af4def5c74b5
SHA256

1fc780c4864c6b00e2bbabed30a67f5b4cca78fc42f39392e770c72d5b2031be
SHA512

d2482dbd1095afa8402b54d2ab22dbebf9c8bd633b60bb056eb43df078d844e9eece32b84d9fe6c7c9de054c7a07cf87779cfc32e6bd13b50c59b9ee5d7089a9
SSDEEP

1536:+ChM13d5uA+QZw3D84SAqHdsJboytAhHArr/0nMC4Nt3NIO2NnToIfBO9Mja:w3e06I6JboHAX/0GZH2FTBfB7ja

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	5048	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4576	5048	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	83
PID 5048 wrote to memory of 4576	5048	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	83
PID 5048 wrote to memory of 4576	5048	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9A5B.tmp" "8A'. ':':?'7'/'HKIIIMHJOOMNMCNHBJKKHN$18JJCU"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 304
  2⤵
  - Program crash
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5048 -ip 5048
1⤵
PID:1320

memory/5048-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download