06e72971a89acaf81a486921829515ffc065257c118c87083abe462da3cb48d5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:42

Target

489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe
Size

1.0MB
MD5

489a22d8b4b97f31b38304aaddd1e776
SHA1

06c1b82b1db0c7999c0a47394bf4349435622a24
SHA256

06e72971a89acaf81a486921829515ffc065257c118c87083abe462da3cb48d5
SHA512

28d006e8d54fd073b7275c02070d3c70086243389593c2fa34a32d3864ca59781bbca49ac2fcff031d5562a1c1a850d79ec758edbed73e0cf682c8f10ae1ce53
SSDEEP

24576:CVKEIohMRSfw0RTQZjHKPjiqSMz9xLZ/JO5unIEj9WfzUa1:CVBMiwWTQZjHKPji/MxxcuI6Wfzz1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2224	2248	489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2224	2248	489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2224	2248	489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2224	2248	489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\489a22d8b4b97f31b38304aaddd1e776_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 152
  2⤵
  - Program crash
  PID:2224

memory/2248-0-0x0000000000D50000-0x0000000000E29000-memory.dmp

Filesize
868KB

Download
memory/2248-1-0x0000000000D50000-0x0000000000E29000-memory.dmp

Filesize
868KB

Download