7099b5668e24f9d9b04fe310260e8dacd97c1b1513b00680e1c0014139c35b30

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:40

Target

65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe
Size

321KB
MD5

65e1e10b664d167c25b9c60c9a19b02b
SHA1

3cc71915deded0dc7c010d302dc71b79b4233c5a
SHA256

7099b5668e24f9d9b04fe310260e8dacd97c1b1513b00680e1c0014139c35b30
SHA512

03280e1de1b75d5f32233a5c6d94defece259ebb1df026a4f96fbe68ea894ee69f127759d89aa3afc27c4c14bd0adc7243ee76738655b581bf09720477ea3dcb
SSDEEP

6144:OTj1OTEKnsub1upoH7td/tQqG56Prd3Z5NBA3r14lJDNIl:OFOoKnsub6oHprG5+3a7STY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1964 WerFault.exe 65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe

pid	pid_target	process	target process
2008	1964	WerFault.exe	65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe

description	pid	process	target process
PID 1964 wrote to memory of 2008	1964	65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe	WerFault.exe
PID 1964 wrote to memory of 2008	1964	65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe	WerFault.exe
PID 1964 wrote to memory of 2008	1964	65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe	WerFault.exe
PID 1964 wrote to memory of 2008	1964	65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65e1e10b664d167c25b9c60c9a19b02b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 116
2⤵
- Program crash
PID:2008

memory/1964-0-0x00000000000E0000-0x0000000000135000-memory.dmp

Filesize
340KB

Download