63d0a0da8be10f21f54dbfe82a1fa45c3d370ab060e882fad505b062b5e4d7e1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 05:24

Target

162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe
Size

427KB
MD5

162ab2f3fb62ce5113b707d80c4cfeeb
SHA1

e5a4a5ede39fec8fb7ba7af4be3cd13a49a91d98
SHA256

63d0a0da8be10f21f54dbfe82a1fa45c3d370ab060e882fad505b062b5e4d7e1
SHA512

c62ee526274cc059ab3da3ffd45c1d953ff7b516d1e20a506f8dd51d0a6d0d7bdd9d76d76f398d0314f95301adbab9c37d1ef646e8b7fbac3094c22c41cb4e4a
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3RF:aigYLm5EDJtBJ8hrlurovhfRF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3048	2940	162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe	28
PID 2940 wrote to memory of 3048	2940	162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe	28
PID 2940 wrote to memory of 3048	2940	162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe	28
PID 2940 wrote to memory of 3048	2940	162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\162ab2f3fb62ce5113b707d80c4cfeeb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 116
  2⤵
  - Program crash
  PID:3048

memory/2940-0-0x0000000001040000-0x00000000010AF000-memory.dmp

Filesize
444KB

Download