12c57097ed3230de94f313c6a05916f2c001e24ba9d17a1bb382a06abd315c0e

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:37

Target

65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe
Size

3.8MB
MD5

65e04ed63af53476f23ec7f6a9ce4812
SHA1

6a50eb6a8e155c035b27353cd7d878f6815d618c
SHA256

12c57097ed3230de94f313c6a05916f2c001e24ba9d17a1bb382a06abd315c0e
SHA512

5ab0dc43e3eceb43e290ef70a1022e6716d24711150e62b40c5b0afe0b0b0e04f6d2f988e8a5bfb02621b9682731883ad9fccf785d9cda5e39ec5d109ac47873
SSDEEP

49152:Da8Hz1hzcFtE9NRESo/ckGKhRRkfrrfRv3BEW/T+:b7zn9WLDRkfPRPuq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1640 WerFault.exe 65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe

pid	pid_target	process	target process
1628	1640	WerFault.exe	65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe

description	pid	process	target process
PID 1640 wrote to memory of 1628	1640	65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe	WerFault.exe
PID 1640 wrote to memory of 1628	1640	65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe	WerFault.exe
PID 1640 wrote to memory of 1628	1640	65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe	WerFault.exe
PID 1640 wrote to memory of 1628	1640	65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65e04ed63af53476f23ec7f6a9ce4812_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 228
2⤵
- Program crash
PID:1628

memory/1640-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/1640-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download