f1f932ca23a4079d40b52a25ae7d53da097ba7fe06b15d1fbee5d15a4eb586a3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:21

Target

65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe
Size

430KB
MD5

65d59e2c26c9ae1e8424cac5927d4ae3
SHA1

7ff00d2013998c7622f95cd1eec89427a5c98455
SHA256

f1f932ca23a4079d40b52a25ae7d53da097ba7fe06b15d1fbee5d15a4eb586a3
SHA512

efffc1138f3381de2b218a6f3bf1e4e9ac7427eb37fc02df674a8ebf0df1f1bbee58e1f6e8fc217e8b8b04d9c0a2a41c464556a97264f0b2506ae5b8b4edf1eb
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4rA:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 2868 WerFault.exe 65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe

pid	pid_target	process	target process
2984	2868	WerFault.exe	65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe

description	pid	process	target process
PID 2868 wrote to memory of 2984	2868	65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2984	2868	65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2984	2868	65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2984	2868	65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d59e2c26c9ae1e8424cac5927d4ae3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 116
2⤵
- Program crash
PID:2984

memory/2868-0-0x0000000000140000-0x00000000001B0000-memory.dmp

Filesize
448KB

Download