13e47c71f37af4adbe6f8c89944a5fce9ed6e04113cdaecb3c5b98ee32ecd181

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 21:41

Target

f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe
Size

76KB
MD5

f462ca3752da48a752d1faaad4cdf8f9
SHA1

cf3e84965d9ce340a3cfcd906da5aba234a037ec
SHA256

13e47c71f37af4adbe6f8c89944a5fce9ed6e04113cdaecb3c5b98ee32ecd181
SHA512

0462aa51b4c781386b19b50ae32dc9622495f7f378ae4f0fb77691ad170458d859eb2154e52c238b0bf4971fae14f9ec96223e6732137ce3336de2005a741a77
SSDEEP

1536:vOPgyYe/Yhsul+TnbkdN7J/Q2JrcoXLib8oW1aOOpjVrs2ryrd1vUQuq6:vtVewHl+Tb2N7J/2WtL1aOOHs2qo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1692	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1072	1692	f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe	28
PID 1692 wrote to memory of 1072	1692	f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe	28
PID 1692 wrote to memory of 1072	1692	f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe	28
PID 1692 wrote to memory of 1072	1692	f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f462ca3752da48a752d1faaad4cdf8f9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 36
  2⤵
  - Program crash
  PID:1072

memory/1692-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download