5ee5445f2a894a5a2950aec4654680144a314cd1cb5da2f498866dddc4036095

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 12:47

Target

f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe
Size

738KB
MD5

f805a8a3cf7554f69b76ab6949cd4dd8
SHA1

02bfeb909c3673b9028b75b0d6787f5230c580fc
SHA256

5ee5445f2a894a5a2950aec4654680144a314cd1cb5da2f498866dddc4036095
SHA512

897c65c7dbec5d4f07239288e28f8084b6cbb494149356285b7234fe5d8e2940bf715e41065bbba4ec4629f1c3951ced7f18a8f8f2bf18a4cd60ebfdc129544c
SSDEEP

12288:EAwSfxL/2Dc3WDLLmt0LDQewsHj7cLppsC3IrKf9ugohbZZfY5NK/w56VEp:ZfewsHj7clXtf96t+5New57

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2032	1728	f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2032	1728	f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2032	1728	f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2032	1728	f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f805a8a3cf7554f69b76ab6949cd4dd8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 124
  2⤵
  - Program crash
  PID:2032

memory/1728-0-0x0000000001280000-0x000000000136F000-memory.dmp

Filesize
956KB

Download
memory/1728-1-0x0000000001280000-0x000000000136F000-memory.dmp

Filesize
956KB

Download
memory/1728-2-0x0000000001280000-0x000000000136F000-memory.dmp

Filesize
956KB

Download