bf2759f6ca74df0bd7f5459648acaa81955fc20598db9bd8aa232416c25a1ffb

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 08:19

Target

5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe
Size

392KB
MD5

5fb9e9141801956a7a167ab660446d41
SHA1

07f35e087c15b202433d225cfcd76fc1b877d06f
SHA256

bf2759f6ca74df0bd7f5459648acaa81955fc20598db9bd8aa232416c25a1ffb
SHA512

cea5515b103438c34210e468870c2d173f831bcf00856d45772a6c0a2e108430f01a091d4aae8fbe5fea851e0f1a5853de8226843b8587dbc109180581f11a78
SSDEEP

6144:xKNJpz91PscwD/u+yFeLOaJFPnYttuUkhkA0nVKenxsNoLxFMn90e:S91k7D/uneSakttuVivVpnwnW

Score

7^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/memory/1616-4-0x0000000000400000-0x0000000000427000-memory.dmp	aspack_v212_v242
behavioral2/memory/1616-7-0x0000000000400000-0x0000000000427000-memory.dmp	aspack_v212_v242

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4516	1616	WerFault.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84
PID 2152 wrote to memory of 1616	2152	5fb9e9141801956a7a167ab660446d41_JaffaCakes118.exe	84

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1616 -ip 1616
1⤵
PID:3640

memory/1616-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1616-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2152-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2152-2-0x0000000000401000-0x0000000000433000-memory.dmp

Filesize
200KB

Download
memory/2152-8-0x0000000000401000-0x0000000000433000-memory.dmp

Filesize
200KB

Download