d7a06cddfc9fcb035028a383b32372519076eab220b4f169c70f490cf27f4a02

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 08:04

Target

4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe
Size

166KB
MD5

4d749aa8b3d915d74ae342f2bef4c338
SHA1

fdb25fcca4e02887a5e67653755e8e419889b075
SHA256

d7a06cddfc9fcb035028a383b32372519076eab220b4f169c70f490cf27f4a02
SHA512

6e70ac133e5ec98e5def4e41cdb18e9066330d571fe1324e75c07c63deb3f60c6cadee4dfb9a4818079a1cd9e96989434a76ca5c5fad4dfdeaf46444c8041732
SSDEEP

3072:PdKFOoL16AhMWO6nL+AF7quHOT0JqLPoAr:VKF/LA4nqAeoqLxr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3604	4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	3604	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3604	3456	4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe	83
PID 3456 wrote to memory of 3604	3456	4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe	83
PID 3456 wrote to memory of 3604	3456	4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 464
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3604 -ip 3604
1⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\4d749aa8b3d915d74ae342f2bef4c338_JaffaCakes118mgr.exe

Filesize
96KB

MD5
8c51fd9d6daa7b6137634de19a49452c

SHA1
db2a11cca434bacad2bf42adeecae38e99cf64f8

SHA256
528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3

SHA512
b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837

Download Submit
memory/3456-0-0x00000000000B0000-0x00000000000DC000-memory.dmp

Filesize
176KB

Download
memory/3456-6-0x00000000000B0000-0x00000000000DC000-memory.dmp

Filesize
176KB

Download
memory/3604-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3604-7-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3604-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download