8e38e413467af966bf0bbbdf336ff7fce2d40f9830c39caa6e846a35a883bf57

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 09:17

Target

102bd06aab990368395585e835bd1c05_JaffaCakes118.exe
Size

260KB
MD5

102bd06aab990368395585e835bd1c05
SHA1

144887aa18e4522ac91bd695c8aadc57c6499b25
SHA256

8e38e413467af966bf0bbbdf336ff7fce2d40f9830c39caa6e846a35a883bf57
SHA512

603b6354a3d83c13c60c2401f67878637415bedc7c8d0a7213434166b2700cbb98318918c3ac49a77474de8680045c5ce5341ec87d6c2182e1c42f4e1af79155
SSDEEP

3072:5TK1Jm5olUp1TfagIQZFqzAzbQVNiH0yl9VfJmbNV7tAye:5+1JmCmprIYFqGbQVodl9VfApDAye

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1912	2220	102bd06aab990368395585e835bd1c05_JaffaCakes118.exe	29
PID 2220 wrote to memory of 1912	2220	102bd06aab990368395585e835bd1c05_JaffaCakes118.exe	29
PID 2220 wrote to memory of 1912	2220	102bd06aab990368395585e835bd1c05_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\102bd06aab990368395585e835bd1c05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\102bd06aab990368395585e835bd1c05_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 68
  2⤵
  PID:1912

memory/2220-0-0x0000000000450000-0x0000000000473000-memory.dmp

Filesize
140KB

Download
memory/2220-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download