642f35a7f4e0bace7ea2b3904c63e3d106a3e5534542839af2571bbd671d45ef

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 10:28

Target

fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe
Size

216KB
MD5

fc8d00872b835826aae14a1860c78ae9
SHA1

711254b7ec6f023a9e17fa487c67d5108499f9fa
SHA256

642f35a7f4e0bace7ea2b3904c63e3d106a3e5534542839af2571bbd671d45ef
SHA512

b2469459d6fb34fb4ee9e7e81ada65e89018766be8c628ece4dcc4f21bffd71385ed4a5b0cab45343e174256a12d3985e35fde64b3ea1fadde44bd7b0ab9fc2e
SSDEEP

6144:GWA2ISOsdYR1fE/pxe7hNO6TGS9JITjaxSMKEbpJ:ced8eL4HV9Je0BtJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	2256	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1936	2256	fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1936	2256	fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1936	2256	fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1936	2256	fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8d00872b835826aae14a1860c78ae9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 168
  2⤵
  - Program crash
  PID:1936

memory/2256-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2256-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download