21d859f2ab0b083e5da9d41fbcc09717644c509559d9174118933bd4cf2dc2dc

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 15:12

Target

0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe
Size

227KB
MD5

0ed8bf935c51885883bcf99737f19c3c
SHA1

e79f58b719f5977b8f2a3e0c9d7c1f8422334b94
SHA256

21d859f2ab0b083e5da9d41fbcc09717644c509559d9174118933bd4cf2dc2dc
SHA512

41495d3996f2ab6e5c13386f4709c36d9310b9172b59649346e625eeed49643b3e7b7aec5014619defa7ccd3db4ad6cc94393a2f8354d45812fd30922f0496d0
SSDEEP

3072:kLwns0hlO57pMAWWsdVkkjAs7UdXaHMV+GyvuDEVazUKWFrj8zP+rlw1brZw+SH9:kLwnvAgWsjAmUFa1GymDEVACgbrLg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	1180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2268	1180	0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe	28
PID 1180 wrote to memory of 2268	1180	0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ed8bf935c51885883bcf99737f19c3c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 120
  2⤵
  - Program crash
  PID:2268

memory/1180-0-0x00000000003B0000-0x00000000003C1000-memory.dmp

Filesize
68KB

Download
memory/1180-1-0x00000000003B0000-0x00000000003C1000-memory.dmp

Filesize
68KB

Download