818d9e5b9331a66770abc369cd3db42432e09a347f6e068e1f4cb938c5ec7da0

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:28

Target

656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe
Size

35KB
MD5

656bdd06ffcf4f361dd4614336a2f543
SHA1

e833441e9fe13df11626a7da92943f87efe3bdf6
SHA256

818d9e5b9331a66770abc369cd3db42432e09a347f6e068e1f4cb938c5ec7da0
SHA512

2622c2b887f8fc957d8a0e96682eb62a0e9709fe38ae8c655f5a85e57fcda1d183d185036944d4b195494a2040c3b328026c23a0b222755dc3a2850117c7f85a
SSDEEP

768:bJDI8yje1xw7KwzNlTV6kU/Y8u5/LdDQ:bJDk2kl4V/G5pU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	4904	WerFault.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89
PID 2160 wrote to memory of 4904	2160	656bdd06ffcf4f361dd4614336a2f543_JaffaCakes118.exe	89

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4904 -ip 4904
1⤵
PID:1640

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20240723-0125.dmp
1⤵
PID:3356

memory/2160-4-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4904-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download