a1a142e502132e5462cb0250f8f50a3c072fd427d94c499bc17d988c1c517e04

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:06

Target

65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe
Size

1.5MB
MD5

65a1ef3a5e5f6c9a185586de54da9a5e
SHA1

a6b91cb5cdbd413174fa7c961aab703bdbc793cb
SHA256

a1a142e502132e5462cb0250f8f50a3c072fd427d94c499bc17d988c1c517e04
SHA512

47c742857187f0c6d41745ae54a5aad970ba8d2b103e381f9231164c81b20b6989687899f556acca639f70e0f319092726bc16e96df7cd1ea5ab6d646d9048ce
SSDEEP

24576:ZRutr7f/q0N+kBw9qmoljoXYFDrric/dwVqBthRF32Uo5TeyxP:/I7KhueP0o0DrO2d7Z32Z5Tt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 2292 WerFault.exe 65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe

pid	pid_target	process	target process
1892	2292	WerFault.exe	65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe

description	pid	process	target process
PID 2292 wrote to memory of 1892	2292	65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe	WerFault.exe
PID 2292 wrote to memory of 1892	2292	65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe	WerFault.exe
PID 2292 wrote to memory of 1892	2292	65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe	WerFault.exe
PID 2292 wrote to memory of 1892	2292	65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65a1ef3a5e5f6c9a185586de54da9a5e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 200
2⤵
- Program crash
PID:1892

memory/2292-0-0x0000000001020000-0x00000000011A3000-memory.dmp

Filesize
1.5MB

Download