8d714ea070571586b1fd93961fd587883c8df4c060d46faf3b88a96507d00e76

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 16:45

Target

JaffaCakesTHERANSOMWARE0.exe
Size

2.0MB
MD5

705b803091747a500087d199151ef110
SHA1

558da698637cfa3715cec6a42dd9a2676af22336
SHA256

8d714ea070571586b1fd93961fd587883c8df4c060d46faf3b88a96507d00e76
SHA512

436e4bcf6aff279f1322bad4eca498aa5cfa1efbf907bc09bccdad917ae481f80594c663fe234717451b5c3db25e10d21084539e239c162b9fa89e09272fe3f5
SSDEEP

24576:gRNz5ipkxMGVsW3vRQAAGRgGtOzhBEMYqnjl1cYt5qwrmc:DcMWOAXg1VxYq5x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2668	3040	JaffaCakesTHERANSOMWARE0.exe	30
PID 3040 wrote to memory of 2668	3040	JaffaCakesTHERANSOMWARE0.exe	30
PID 3040 wrote to memory of 2668	3040	JaffaCakesTHERANSOMWARE0.exe	30
PID 3040 wrote to memory of 2668	3040	JaffaCakesTHERANSOMWARE0.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakesTHERANSOMWARE0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakesTHERANSOMWARE0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 840
  2⤵
  - Program crash
  PID:2668

memory/3040-0-0x0000000001000000-0x000000000120A000-memory.dmp

Filesize
2.0MB

Download
memory/3040-1-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-2-0x0000000005070000-0x00000000050B0000-memory.dmp

Filesize
256KB

Download
memory/3040-4-0x0000000005070000-0x00000000050B0000-memory.dmp

Filesize
256KB

Download
memory/3040-6-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-7-0x0000000005070000-0x00000000050B0000-memory.dmp

Filesize
256KB

Download