014ce382bbb7d6401bc3f12a0201605802177258907d4cca1de108b2a93c4ca3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:12

Target

4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe
Size

286KB
MD5

4c2b9a6771066d537843a19ba68de725
SHA1

ba02161af32855bed646afbc69a57c6397a415b9
SHA256

014ce382bbb7d6401bc3f12a0201605802177258907d4cca1de108b2a93c4ca3
SHA512

52ffd643c0a7e8099b84388942400bb04423dde66ac7716391b978266f0774fd470e3d1e90c562810952b1b0509b347998887d5706c45c48062662f25a628b33
SSDEEP

3072:ypO09W2NaB1bv4mErqaxFavrvqpD4pH+3BipHmd4pXojGj3:yBpg+RipHmd4GGj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2264	2172	4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2264	2172	4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2264	2172	4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c2b9a6771066d537843a19ba68de725_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 532
  2⤵
  PID:2264

memory/2172-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000000DD0000-0x0000000000E1A000-memory.dmp

Filesize
296KB

Download
memory/2172-2-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download