58d426a030bd77441ce36514ba2b0148d18258624a7b72a693072d08a8f8f455

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 07:40

Target

f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe
Size

80KB
MD5

f097c2134d5d6a900f9decc6b1811428
SHA1

5dc37fc808c25d53dc10d417fcc326f263a35069
SHA256

58d426a030bd77441ce36514ba2b0148d18258624a7b72a693072d08a8f8f455
SHA512

fe928f9937f2fc17d9c3edebe5e5ad9f31721aeb77df740c47802706a85bf0d79bbc817e4dd05daf1505e3d6b8d34ef61103c40a01a514084387e43a933da4ef
SSDEEP

1536:qDD2dsj2ba9/3yYQ5dyD+YgrdVlTZw1o7eKjiTlcUF:kydsybyCZkgp3Zw1mhMlh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3020	2180	f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe	28
PID 2180 wrote to memory of 3020	2180	f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe	28
PID 2180 wrote to memory of 3020	2180	f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe	28
PID 2180 wrote to memory of 3020	2180	f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f097c2134d5d6a900f9decc6b1811428_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 120
  2⤵
  - Program crash
  PID:3020

memory/2180-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download