459290276a09f4f9e06acb7d9584fafdc98f3e86a4095fafff8e0762779972fd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:23

Target

03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe
Size

364KB
MD5

03c23f60efcc0b238b1647e85580dfc4
SHA1

07b7449b59caf93ec497c9a0d4e9fb916dbaa123
SHA256

459290276a09f4f9e06acb7d9584fafdc98f3e86a4095fafff8e0762779972fd
SHA512

dc45af0a1abc6bcff20b80c6b918d39c2f9ba14b6f9e08dc424e2c7d43597c8cb7e89f4e0347aeb96558bab07acaf852f5151c8a2593425ab805390c255e3ce0
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+W:rTAOm5eyUnJmCzAXTzJR3RvK6lCwW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 2036 WerFault.exe 03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe

pid	pid_target	process	target process
2996	2036	WerFault.exe	03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe

description	pid	process	target process
PID 2036 wrote to memory of 2996	2036	03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe	WerFault.exe
PID 2036 wrote to memory of 2996	2036	03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe	WerFault.exe
PID 2036 wrote to memory of 2996	2036	03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe	WerFault.exe
PID 2036 wrote to memory of 2996	2036	03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c23f60efcc0b238b1647e85580dfc4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 116
2⤵
- Program crash
PID:2996

memory/2036-0-0x0000000000800000-0x0000000000860000-memory.dmp

Filesize
384KB

Download