e728d6e8e79afe2da0cb0cdfc1e2f8fba26e2eec499f9a614333c9a3cde35e33

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 15:31

Target

f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe
Size

319KB
MD5

f163d8c4e21681405ef7537c0cab01d0
SHA1

4f20ed993adc376cddc451dcde217358c00eb8a6
SHA256

e728d6e8e79afe2da0cb0cdfc1e2f8fba26e2eec499f9a614333c9a3cde35e33
SHA512

d312d9fd782f2858d5a45713e17c1472da43f29004567eefbffcfb9179f642349badbc83a4f37c29e7724cc346df0cb95c49db2bf54f696e6890d26ca8c116c1
SSDEEP

6144:6ZGwyZlVrtv35CPXbo92ynn8sbeWD2/o85/LCSuS5CPXbod:6ZGrHRFbe7w8NL5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2948	2860	f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2948	2860	f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2948	2860	f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2948	2860	f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f163d8c4e21681405ef7537c0cab01d0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 140
  2⤵
  - Program crash
  PID:2948

memory/2860-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download