57dcf46619ebd69eeab99448f0d805481f03950943cce68520684ba66216a06e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:12

Target

654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe
Size

368KB
MD5

654dc98d6237a77c480b83369f74e411
SHA1

d1325068d129c19665dcc1803e8469922b261d25
SHA256

57dcf46619ebd69eeab99448f0d805481f03950943cce68520684ba66216a06e
SHA512

43d3469a9c27598004dd3a7cb1a4acb91da37cffac4002abe7c7c9678c464f5ce5b0aadcdd049bd4b448a8e59c591c1d437264ce40c3ff085870e5f5a5dc1461
SSDEEP

6144:RTAp4naqm5GR/0N4Ftn6vicI8qtQQenKDFujBeqSDgzB8jk3k:R041m5Q/0N4L9xYus1NSD2Cg3k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2384 2188 WerFault.exe 654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe

pid	pid_target	process	target process
2384	2188	WerFault.exe	654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe

description	pid	process	target process
PID 2188 wrote to memory of 2384	2188	654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe	WerFault.exe
PID 2188 wrote to memory of 2384	2188	654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe	WerFault.exe
PID 2188 wrote to memory of 2384	2188	654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe	WerFault.exe
PID 2188 wrote to memory of 2384	2188	654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\654dc98d6237a77c480b83369f74e411_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 116
  2⤵
  - Program crash
  PID:2384

memory/2188-0-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Filesize
384KB

Download