a861eef3b3ab7bc941bb820892a33571d16fccb73ebba17d1062b907b30e6ef7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 20:39

Target

64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe
Size

487KB
MD5

64b0c5e585dd8260b1867e193c581075
SHA1

982210cbd951cfd474b4fce7a38bb6b451872f84
SHA256

a861eef3b3ab7bc941bb820892a33571d16fccb73ebba17d1062b907b30e6ef7
SHA512

7b414937558631d71add6dc601ebe79f8ca7de99d8e3fe5582f1ca7b4aeee6f3ac484597cc49e4299efb19041f0ec430bfc1be9756fbcbacb535d21f17fa301c
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAm:IvOZ7nGm/Yd+GM1aL6EM3htm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2100 3020 WerFault.exe 64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe

pid	pid_target	process	target process
2100	3020	WerFault.exe	64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe

description	pid	process	target process
PID 3020 wrote to memory of 2100	3020	64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 2100	3020	64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 2100	3020	64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 2100	3020	64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64b0c5e585dd8260b1867e193c581075_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 116
  2⤵
  - Program crash
  PID:2100

memory/3020-0-0x0000000000DB0000-0x0000000000E2E000-memory.dmp

Filesize
504KB

Download