e1b275e480e84589a567b8b6b2b61c5516410801bfe2cc949b72be0feddfacee

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:51

Target

63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe
Size

422KB
MD5

63aee9eba309eac4c215037b5d71768f
SHA1

c4689ffb1c0a933267374e1973201d5f9457b618
SHA256

e1b275e480e84589a567b8b6b2b61c5516410801bfe2cc949b72be0feddfacee
SHA512

939fb9f7c120de6a9bf75d0ca5818b1ad47b35c40f20436dd9189e8306ca6fed4a10d4cad897ff09bbf9f4488e32ef6610eb100f99d896b2da1512db5e5bb123
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2952 2880 WerFault.exe 63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe

pid	pid_target	process	target process
2952	2880	WerFault.exe	63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe

description	pid	process	target process
PID 2880 wrote to memory of 2952	2880	63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe	WerFault.exe
PID 2880 wrote to memory of 2952	2880	63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe	WerFault.exe
PID 2880 wrote to memory of 2952	2880	63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe	WerFault.exe
PID 2880 wrote to memory of 2952	2880	63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63aee9eba309eac4c215037b5d71768f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 116
  2⤵
  - Program crash
  PID:2952

memory/2880-0-0x0000000000C70000-0x0000000000CDE000-memory.dmp

Filesize
440KB

Download