66e214dc1be37b684a7c4bc4019ccc969276d4a9bbb33f178da1e4be0025aa5d

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:36

Target

3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe
Size

36KB
MD5

3dc7c6be3f52b0085d638cf697cbf5a8
SHA1

d8dd2bceb212c3aa0705a299c68e00bee0a90386
SHA256

66e214dc1be37b684a7c4bc4019ccc969276d4a9bbb33f178da1e4be0025aa5d
SHA512

0e81cb930c16aa1e48ea0d6aa42f8eb665862490cada07ef8e7e9ef481de1efc7da44ccc2dbc03a243a1e6829e23757c2aad4536768bd2d1d2ed0425e2054d4c
SSDEEP

768:BLlqpWmqNebg3lMXHPJgSrOP5UcEOwYYd/N/h0mlFZVQrjWK:xlqpWmIebIlM3PWS8U6uZ00Qr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1552	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86
PID 4232 wrote to memory of 1552	4232	3dc7c6be3f52b0085d638cf697cbf5a8_JaffaCakes118.exe	86

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1552 -ip 1552
1⤵
PID:3808

memory/1552-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1552-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1552-8-0x0000000000400000-0x0000000000403200-memory.dmp

Filesize
12KB

Download
memory/4232-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4232-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download