61900e0d99058eb10f4a257e1471f66e4cce9e806f1f6251b7d11a724bcacc2a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:41

Target

f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe
Size

94KB
MD5

f81d3b609424f28466ca243069b2bef3
SHA1

270f63130b145cf8830cb755afc725980006915d
SHA256

61900e0d99058eb10f4a257e1471f66e4cce9e806f1f6251b7d11a724bcacc2a
SHA512

73bfbabd68a2cedb4f0f240030b0df04b20abb42417e4c9819c16c65ec8d8ed8fc4b5562b558c8066051f92afd387c3da54d7ae7b51eaa6bc3547e30ccc6007b
SSDEEP

1536:2xLW7PJ+I+vY20h+6/+p6yTKLFxUJjsZJMq5oY78Fhq:6W1Pe0ox6ZFxUJsZJj5x78Fw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2004	1072	f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe	28
PID 1072 wrote to memory of 2004	1072	f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe	28
PID 1072 wrote to memory of 2004	1072	f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe	28
PID 1072 wrote to memory of 2004	1072	f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f81d3b609424f28466ca243069b2bef3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 36
  2⤵
  - Program crash
  PID:2004

memory/1072-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download