9594265a8ed4ba6c8e64a8fd890da278a195c8e04972814a302e0b35670f6e89

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 23:20

Target

f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe
Size

23KB
MD5

f48cb616cbebd3e6b18df669b7be9255
SHA1

0dc174efb8d1977e1cb62fd9cfc0009c3bb7c92f
SHA256

9594265a8ed4ba6c8e64a8fd890da278a195c8e04972814a302e0b35670f6e89
SHA512

318a109a1b06b1c2d9dd423d6866720b9cb462e5ae3baf065225ab32d044f0f00edcbe459a8a0ae734555a7dccb168e82d8cb3e778733fafa11815f6a73d7982
SSDEEP

384:A8GMsSst08yYP9W0lZvRk7oD5DLwq0/NMTtes6hEoDCsnB9a:/rs5W8/9W8vRksDlLwJNMTtGDCs/a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	2076	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 848	2076	f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe	28
PID 2076 wrote to memory of 848	2076	f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe	28
PID 2076 wrote to memory of 848	2076	f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe	28
PID 2076 wrote to memory of 848	2076	f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f48cb616cbebd3e6b18df669b7be9255_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 100
  2⤵
  - Program crash
  PID:848

memory/2076-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2076-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download