83d1ddabe5a3b884037adb26ab9ad3d9f0536784ec8dcd71f506da0b676d1943

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:21

Target

50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe
Size

367KB
MD5

50d87f16a51067f347fe705f094d6ba5
SHA1

9303d7c6c9d5a68c220370502b492511e7e0802e
SHA256

83d1ddabe5a3b884037adb26ab9ad3d9f0536784ec8dcd71f506da0b676d1943
SHA512

85ca8d3b2b574aabc151fb55e729f718938ed9d42e623cacce49212ac5f5f04d244438a97078a9040b0a306dedcfaaacfe09f2ac5479830fc268ffd5fe059e3e
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+L:rTAOm5eyUnJmCzAXTzJR3RvK6lCwL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2996	2992	50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe	28
PID 2992 wrote to memory of 2996	2992	50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe	28
PID 2992 wrote to memory of 2996	2992	50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe	28
PID 2992 wrote to memory of 2996	2992	50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50d87f16a51067f347fe705f094d6ba5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 116
  2⤵
  - Program crash
  PID:2996

memory/2992-0-0x0000000001250000-0x00000000012B0000-memory.dmp

Filesize
384KB

Download