8718c5633bead4dc385fecb6d00b37adb02297425a86dd06525e7dd3755721f2

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 23:13

Target

4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe
Size

188KB
MD5

4bd3217d91a12d3be5349bd885405db9
SHA1

9c5c23f044c9f393f4f17e3fcbf5863e0f6c2801
SHA256

8718c5633bead4dc385fecb6d00b37adb02297425a86dd06525e7dd3755721f2
SHA512

c0a03680e43193618651029f258d16c8946302dc6a973c44f2744f1780611c05545c61b6943152cafe7818c02f9d9c87268260c38f925c41c04c8e9937031a95
SSDEEP

3072:524WFT68R+PnPbJvyO55dtuJ8sCTp1o2b3iKmpWNBXJKEAH1IKr2knADevZCPTrC:bWu8RaPbgOrQApm2cWNBXqVIa2k8evZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	3228	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 224
  2⤵
  - Program crash
  PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3228 -ip 3228
1⤵
PID:3464

memory/3228-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3228-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download