7db86f5bf4a0f7edbe67feb40c8205f66bfa460e3f7815d0505d7a430b2621c4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 00:23

Target

08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe
Size

427KB
MD5

08980542df32996797e47cf00bb9f9d1
SHA1

6f7f351ab1de381f2f058019472126bcd4880e7a
SHA256

7db86f5bf4a0f7edbe67feb40c8205f66bfa460e3f7815d0505d7a430b2621c4
SHA512

c2e77aba5a043eddc45edeba251e4c6963bf36904909dd79bea87e37395ad185f161b4fa5757ecbd632204a4d07b565de6b959a2a0c3747d3c77ca5851c35d0f
SSDEEP

6144:5kT5mHe6HmbqjAxLMbKcehgraio+eaLsj10w0LkRjTBht27O1ZOmu2z:5SmHe6Hm2jAxLMbK6rVo+eavLkRjTBVz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2128	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2104	2128	08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2104	2128	08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2104	2128	08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2104	2128	08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08980542df32996797e47cf00bb9f9d1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 152
  2⤵
  - Program crash
  PID:2104

memory/2128-0-0x0000000000B00000-0x0000000000B6F000-memory.dmp

Filesize
444KB

Download