33b515c764e92189eec0c493c050eaaf8652cd9b65c8051b1c1d70f3ac31cad6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 23:59

Target

fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe
Size

421KB
MD5

fb753867048a9d2f168057664b34a6d6
SHA1

eccfcc62a95b92f322d1aba220508520af204499
SHA256

33b515c764e92189eec0c493c050eaaf8652cd9b65c8051b1c1d70f3ac31cad6
SHA512

c2e5b0f6d3ed518d366f4e7dc39f829a883ceb844953a828cebf73aa7c91fc7b1229dac139eb213184ff903876d955d571eb2eb3c7ce605f1686d2019f644fee
SSDEEP

6144:dd4Wf1PByTUtSwh+UhVHaY0FbjKbNqVwisC7iBtbm:FBLSYIKb8Mm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
300	2192	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29
PID 2192 wrote to memory of 300	2192	fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb753867048a9d2f168057664b34a6d6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 264
  2⤵
  - Program crash
  PID:300

memory/2192-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2192-1-0x0000000000240000-0x00000000002AC000-memory.dmp

Filesize
432KB

Download