e064e56ec4670cbaf5940937943198f37cdd058fbb485210836db08202a0ce4d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 16:57

Target

f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe
Size

32KB
MD5

f865be8feba39187b33c0f79697698ee
SHA1

bc9495b5f37ba17c000b7ed17b74e37d5c9aa5c3
SHA256

e064e56ec4670cbaf5940937943198f37cdd058fbb485210836db08202a0ce4d
SHA512

63fb2efecb920bf3b41d7a166ca6c1266969e53635e8cba6626d6026b73d1af272c888d4c1e83e1c136b05e2b6b58f2e36b4dbce056854f97a1d9f504765cf67
SSDEEP

384:WCpafbDMD2pxbSPYUd50o2JWeKF1u8TZmTgJg:87xbG950o2AeKF1u8ggG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1380	2132	f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe	28
PID 2132 wrote to memory of 1380	2132	f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe	28
PID 2132 wrote to memory of 1380	2132	f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe	28
PID 2132 wrote to memory of 1380	2132	f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f865be8feba39187b33c0f79697698ee_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 88
  2⤵
  - Program crash
  PID:1380

memory/2132-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download