e7d331646eced3235000422e859e535b53a64cc7f703d2d1f99d7ffe9822e970

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 21:45

Target

f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe
Size

368KB
MD5

f1fe5dc5098d86f99248808eb28bf1d1
SHA1

59e16a7b8bf246c3be37ba27933b2ce0c552f144
SHA256

e7d331646eced3235000422e859e535b53a64cc7f703d2d1f99d7ffe9822e970
SHA512

158d5ada79c045c2d21d07e3604bd3d52d78dc9f42c810ff87030d2f83b33bbf2677a246f4f388dd21bfab1de4fa21211d0e7c62305bb5575972223f86b8c818
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3e:R041m5Q/0N4L9xYus1NSD2Cg3e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2960	1924	f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2960	1924	f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2960	1924	f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe	28
PID 1924 wrote to memory of 2960	1924	f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1fe5dc5098d86f99248808eb28bf1d1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 116
  2⤵
  - Program crash
  PID:2960

memory/1924-0-0x00000000002E0000-0x0000000000340000-memory.dmp

Filesize
384KB

Download