a646752bdb9c3f66cdd09fd0190e5b795bbccff17dc779a72cfb868a7ecffa6a

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 08:09

Target

f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe
Size

77KB
MD5

f30efe28b91be6fce8a20ae7f0614c1f
SHA1

458ac22e7521d5841359b7752d025ceb3b1b6ee4
SHA256

a646752bdb9c3f66cdd09fd0190e5b795bbccff17dc779a72cfb868a7ecffa6a
SHA512

cc2e55710ce4ef381727e228157c70fb22110625a9a5827e2ac83ab42089911f3cd759174eda454dc3719cc453712f4932ac393bf3f06a702330a46402a8d80f
SSDEEP

1536:3UlOONcO1dQisr6URXNN+0XH9oLCylTra8MO7hSLai0:3UTNTd7sOiXNYeUxa837h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2196	2368	f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2196	2368	f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2196	2368	f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2196	2368	f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f30efe28b91be6fce8a20ae7f0614c1f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 100
  2⤵
  - Program crash
  PID:2196

memory/2368-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2368-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2368-2-0x00000000002A0000-0x00000000002B6000-memory.dmp

Filesize
88KB

Download
memory/2368-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download