8995a3f7f71e4a46283a1cee039b193d91e009cdd832d3af8d99a242df372729

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 12:38

Target

1a245741c4f155f77881205e85d93994_JaffaCakes118.exe
Size

754KB
MD5

1a245741c4f155f77881205e85d93994
SHA1

baba00bc18be3560fa54b2e0d094b424143cb57e
SHA256

8995a3f7f71e4a46283a1cee039b193d91e009cdd832d3af8d99a242df372729
SHA512

3c8a228ff97abec5b8e28563f2d300c1255f006408f2be81a66e8b32e89825b48dbcbde9b3ea0922d9c9faca9c542701f43cc07f2d414bf2a0115ab9ebeeefe2
SSDEEP

12288:vYaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdh:hAEENIq8XwyVPQclDq/+WnpsS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 1288 WerFault.exe 1a245741c4f155f77881205e85d93994_JaffaCakes118.exe

pid	pid_target	process	target process
2636	1288	WerFault.exe	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1a245741c4f155f77881205e85d93994_JaffaCakes118.exe

description	pid	process	target process
PID 1288 wrote to memory of 4660	1288	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe
PID 1288 wrote to memory of 4660	1288	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe
PID 1288 wrote to memory of 4660	1288	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe	1a245741c4f155f77881205e85d93994_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a245741c4f155f77881205e85d93994_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a245741c4f155f77881205e85d93994_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\1a245741c4f155f77881205e85d93994_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a245741c4f155f77881205e85d93994_JaffaCakes118.exe"
2⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 260
2⤵
- Program crash
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1288 -ip 1288
1⤵
PID:3672

memory/1288-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download