c4f296f8598d581d264af85ed1af8b17a78a3664dcfd3a4c2345d93c578dab8b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:20

Target

68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe
Size

321KB
MD5

68fabac1f641e18d6a1f49d2e9ac9b0a
SHA1

3a925e3a6065837b1b28e5ab826a81830aba8de2
SHA256

c4f296f8598d581d264af85ed1af8b17a78a3664dcfd3a4c2345d93c578dab8b
SHA512

cb35a8b073ce2d2a460772a3ef22f89c9bde2eec50b343edf878955cdc85d7d6c38fd2e71bbdee8e8b178f297ee432ecb8d66557d9baebb0532669669ec9582a
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1828 3020 WerFault.exe 68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe

pid	pid_target	process	target process
1828	3020	WerFault.exe	68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe

description	pid	process	target process
PID 3020 wrote to memory of 1828	3020	68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 1828	3020	68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 1828	3020	68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe	WerFault.exe
PID 3020 wrote to memory of 1828	3020	68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68fabac1f641e18d6a1f49d2e9ac9b0a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 116
2⤵
- Program crash
PID:1828

memory/3020-0-0x0000000000E70000-0x0000000000EC5000-memory.dmp

Filesize
340KB

Download