5822d2db25742dee13a548637b635bd99cc91aa067afd942794dc9ae2b7ed1ee

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 03:38

Target

5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe
Size

75KB
MD5

5a51cf87a555a681c6ab52848d6027fd
SHA1

ee8c005edf37f22a5d01f15866ca5df2b0e2a6fd
SHA256

5822d2db25742dee13a548637b635bd99cc91aa067afd942794dc9ae2b7ed1ee
SHA512

141d3bd7c6f23f38adf44e08ce1e6386f959ed18c4dcec63abc653d12b22d449b3682213a9c44b6731c0ad42393af1449f4bd184cfc0fa89130a621eacd3fb33
SSDEEP

1536:YmqwAeISCKibdY954Q1QpWTFU7M9PK2FwT4qDCV9SNqu:Y3tSCKsdYqWvFwT434

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.dll	5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe	5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe	5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2420	4856	WerFault.exe	83
4652	4856	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe
4856	5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a51cf87a555a681c6ab52848d6027fd_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 464
  2⤵
  - Program crash
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 508
  2⤵
  - Program crash
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 4856
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4856 -ip 4856
1⤵
PID:3932