58df1a281d94f0a98d513291e2cd30cd70a61a8087210254f6e1959171bafb15

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 16:44

Target

f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe
Size

20KB
MD5

f85ffb0bca553b27f594b50f12b0ff1d
SHA1

7344097af01785da4681e1c4c89401e0eae70f07
SHA256

58df1a281d94f0a98d513291e2cd30cd70a61a8087210254f6e1959171bafb15
SHA512

ff6f8ec34890d3e01364f0151f9fc28bd2a4bac4315a47abea5203d41c880b9cfe2a25114e7999379323a6d7cbddff7017ae9c3d425dec8c4ad9789070681d30
SSDEEP

384:g9WzygBq0SNWNhv57tKeC6rIvtfBofrQGb7pL7zeWi9qGfGVdlmB:EjgBWNavZtKeC6k1Zsb7pL7C3fYI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1628	1912	f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1628	1912	f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1628	1912	f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe	28
PID 1912 wrote to memory of 1628	1912	f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f85ffb0bca553b27f594b50f12b0ff1d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 88
  2⤵
  - Program crash
  PID:1628

memory/1912-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download