2f1e1aa6934fc23187f471b018d7a06290d4f04756bb0b62f349e5c26c997253

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:02

Target

f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe
Size

43KB
MD5

f942e82d4241207fdd622c50671562ec
SHA1

c453be6ea55d0c96696a363e26d19175ce451e88
SHA256

2f1e1aa6934fc23187f471b018d7a06290d4f04756bb0b62f349e5c26c997253
SHA512

a9a5b3c0aee241274e095642a6f3aa9e30cc3c3e6a3f5f411765c5905cfe308f40c1d4a1261c66f68690e8e898ad9858fe404b8b0f28542615a0ef6a6d6acb4f
SSDEEP

768:+SvdudTv/T2QxjEQuvjrSrrGbV+Fx1c1NSp5JlKIKH2QoqkohTi+nIX9bHrV+X:TvdYTvbxAQuvjrFbV+0OJGH2vqZZON7K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	2388	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1876	2388	f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe	28
PID 2388 wrote to memory of 1876	2388	f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe	28
PID 2388 wrote to memory of 1876	2388	f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe	28
PID 2388 wrote to memory of 1876	2388	f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f942e82d4241207fdd622c50671562ec_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 36
  2⤵
  - Program crash
  PID:1876

memory/2388-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download