197c01599eeca7c83a565e8fffdd1eeca44279c0225ba4c4ce5c0878041875eb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 15:12

Target

fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe
Size

43KB
MD5

fd0c429f2ab4dbe04a867b3ef10290c1
SHA1

a9c33a750627839d3d0986cca78595bb5b43c456
SHA256

197c01599eeca7c83a565e8fffdd1eeca44279c0225ba4c4ce5c0878041875eb
SHA512

f202c2d7e9b0deba2d1dfb22dc874a2a5107f3e205c17be3f57b4e59827d3b87be87bc66bc8f6d6b946e85cd6c9643fa5689e6c0f0f0c48c39380d6e68acf7bb
SSDEEP

768:vM3ADl60KL+KbIqgdevER/FMGbb8Tqq0K73+3LtpKbaAsypCi1vVjcvmbatS:EQmK05gdem/FLbyqcOb01sqokMS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1724	2080	fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe	28
PID 2080 wrote to memory of 1724	2080	fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe	28
PID 2080 wrote to memory of 1724	2080	fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd0c429f2ab4dbe04a867b3ef10290c1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 40
  2⤵
  PID:1724

memory/2080-0-0x0000000100000000-0x000000010000F000-memory.dmp

Filesize
60KB

Download
memory/2080-1-0x0000000100000000-0x000000010000F000-memory.dmp

Filesize
60KB

Download