60481fe71e614b830939982a332fa747bffb3ec284153d9cf4d94149eca7b67f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 09:20

Target

243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe
Size

427KB
MD5

243060d4656e646e6fc86c4486ee4479
SHA1

fa9c003f5728a1fe1a8a24bfe5fffa292d2f4c93
SHA256

60481fe71e614b830939982a332fa747bffb3ec284153d9cf4d94149eca7b67f
SHA512

d1372d741c49e7632dda0d76e8944fdff8f7fa427d12a400a16c39454952a41cef81c6596a413c7529a0a7756fcd96b397810320e7bfccd4a9372f91167e26a3
SSDEEP

6144:aiFUvYoYDm5v8DJtBTd8dbVTh2adDWAzuroj3zjlYL1Q3Ry:aigYLm5EDJtBJ8hrlurovhfRy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2872	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2928	2872	243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2928	2872	243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2928	2872	243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe	28
PID 2872 wrote to memory of 2928	2872	243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\243060d4656e646e6fc86c4486ee4479_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 116
  2⤵
  - Program crash
  PID:2928

memory/2872-0-0x0000000000880000-0x00000000008EF000-memory.dmp

Filesize
444KB

Download