ac73a71e8441b63a57c8271334727b9698a6c1848833fc162321770b51438659

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 03:26

Target

f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe
Size

79KB
MD5

f03294c918ea0cc8e667e4df4608b637
SHA1

b1e01cd1fa5b699878ea6b94d15b4571ddfdc0f8
SHA256

ac73a71e8441b63a57c8271334727b9698a6c1848833fc162321770b51438659
SHA512

ac62c681e93eca4c41f39862d42bd40e332ed6d20693068682ef9c2beffc22ac129c6d17fd7f58fee3ceedf91c2c25e7894b4052ea050d68f85006775eedb900
SSDEEP

1536:tYM/ogo5yX1mIOjCy+9OKAq1AY0KOyYcRw2MJOnxMrIWE0EHqiAo7Lxaf6://oTyXcIECykfZ0KOncRdMIxM8WE08qe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3052	3040	f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f03294c918ea0cc8e667e4df4608b637_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 88
  2⤵
  - Program crash
  PID:3052

memory/3040-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download