367577d5aa5c0a671b181484707759fb00f4c019ae92b112b3f7c924ef7dd08b

Analysis

max time kernel
142s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 03:03

Target

ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe
Size

35KB
MD5

ec89792cf7553414fe3f40316366f49a
SHA1

9e262bfa76db90b03d72bc1458c51432cd78e8f3
SHA256

367577d5aa5c0a671b181484707759fb00f4c019ae92b112b3f7c924ef7dd08b
SHA512

67d080433b57da8d1c9c56b060fe45ee14a433a7af02eb2aa7dc10582fbc9e7397586bf4f143564789d4c99f74fd088b9b392a55513ba6e39885854846de3ca7
SSDEEP

768:GrL1vgCGESyQu2HujWEgUG9tJoCrK5ZxD7OEry288RxXzSlH9K2At:G31vAESvuHgrtJoCrIxD7UGo4t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2072	WerFault.exe	27

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 2092	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	28
PID 2072 wrote to memory of 1708	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 1708	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 1708	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 1708	2072	ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec89792cf7553414fe3f40316366f49a_JaffaCakes118.exe
  2⤵
  PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 120
  2⤵
  - Program crash
  PID:1708

memory/2072-2-0x0000000000010000-0x000000000001F000-memory.dmp

Filesize
60KB

Download
memory/2092-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2092-1-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download