7b9532c402d370de2511efc48acf76a8dd604be592c2cbb5d7d75c85cbb82b17

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 12:25

Target

e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe
Size

23KB
MD5

e28a479b93e1e3b61a6d309adc5e7164
SHA1

d3dd5f7d2eb8a452e14fa4a91f1acc1a51a67801
SHA256

7b9532c402d370de2511efc48acf76a8dd604be592c2cbb5d7d75c85cbb82b17
SHA512

aebb31c381974e1343e2f087928aef6909e271d5c0e31d7a7459746ce73c1607f4f6bfe5f7a428316fbde82abf4528a6305c5ba278283ce828490a73ef62f38a
SSDEEP

384:6J7uBKAqh4OLsDMyelBGKKJV0x8j8ikgk5s19m4OzuV7CSUjd:6MBbqiOLtyelEJ4+gAk5Y9lV7Cnd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	1636	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2220	1636	e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2220	1636	e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2220	1636	e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2220	1636	e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e28a479b93e1e3b61a6d309adc5e7164_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 116
  2⤵
  - Program crash
  PID:2220

memory/1636-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download