b932efa41448ef7ac1e5d1a3afe00405e633c0010fa5b9053714cb368235b5c4

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 12:44

Target

fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe
Size

55KB
MD5

fa51c7d453801cc822f68d75f2cdba99
SHA1

603f4bc9175d40f2bc9c4230c83ccae37b47e0a1
SHA256

b932efa41448ef7ac1e5d1a3afe00405e633c0010fa5b9053714cb368235b5c4
SHA512

7c85b5f16386aefd4ac118ae3ec685fc29ef7e773603a81c8019c492cfe6ad21428979c0284a7116e0b8b8865bdc39edebc78877440a045ec27f332f7613543f
SSDEEP

1536:O44KZAkC/Jec+n7OvUkDltK7F01T3Gt9oZC3+YAVbYHX2L7:14KZS/Jec+n7OvUkDvKRPt9oZC3+YiYw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2860	2776	fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe	28
PID 2776 wrote to memory of 2860	2776	fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe	28
PID 2776 wrote to memory of 2860	2776	fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe	28
PID 2776 wrote to memory of 2860	2776	fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa51c7d453801cc822f68d75f2cdba99_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 140
  2⤵
  - Program crash
  PID:2860

memory/2776-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download