d83a8f3a3475132ef153741a21858652a2f03a4e62d56f6864c8800fb0a0da45

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 08:31

Target

e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
Size

268KB
MD5

e480e28c74a635845673fd030eb47734
SHA1

913f51d9deee32c6953a3ce9fbe04dd85f4c78f1
SHA256

d83a8f3a3475132ef153741a21858652a2f03a4e62d56f6864c8800fb0a0da45
SHA512

620d5be5d4874d5f89b2d301e9900fb25c11cf1630c5fd901e8d34e71ea3c467931e3b284bb16309e26a81a79ba1abd945c20ea908917e378fdac356c54e1571
SSDEEP

6144:mU2ggwQt/uqv8uLjPMRnuCKc8E46U+mxHYQsl4DrNr1Hzkmct/036YFTKT:mU1HKc8EnIN5ssrNrumcS36Y6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3424 4804 WerFault.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe

pid	pid_target	process	target process
3424	4804	WerFault.exe	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e480e28c74a635845673fd030eb47734_JaffaCakes118.exe

description	pid	process	target process
PID 4804 wrote to memory of 1116	4804	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
PID 4804 wrote to memory of 1116	4804	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
PID 4804 wrote to memory of 1116	4804	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe	e480e28c74a635845673fd030eb47734_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"
2⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 484
2⤵
- Program crash
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4804 -ip 4804
1⤵
PID:4956

memory/4804-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/4804-2-0x00000000005A0000-0x00000000005A2000-memory.dmp

Filesize
8KB

Download