8b063ccf5480c0ef07b7c8eac360683d31d587ef616281210951b7423ff8ca2b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:47

Target

6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe
Size

827KB
MD5

6893ee9c21e9fca0656b6b434c6c21a8
SHA1

4fa17168b6cbb07700231e7f9393e0b67c4104ae
SHA256

8b063ccf5480c0ef07b7c8eac360683d31d587ef616281210951b7423ff8ca2b
SHA512

158aedf9afeea44b9e5a570f2695443381063219aa25309e446a5f0edf99b8cb30fcdda12e9ce6c7fcd5f4f24bfb0c3a138a126e752108cbdb2ddb9320e1af68
SSDEEP

12288:FNAhaBqAJffwr9y8ViwXJuW/5QbtSLE+l0GtRUyVVwJgMHCaSOITdN:FCAJgrc8VRJgEzViJgZTdN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 1336 WerFault.exe 6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe

pid	pid_target	process	target process
2016	1336	WerFault.exe	6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe

description	pid	process	target process
PID 1336 wrote to memory of 2016	1336	6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe	WerFault.exe
PID 1336 wrote to memory of 2016	1336	6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe	WerFault.exe
PID 1336 wrote to memory of 2016	1336	6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe	WerFault.exe
PID 1336 wrote to memory of 2016	1336	6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6893ee9c21e9fca0656b6b434c6c21a8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 148
2⤵
- Program crash
PID:2016

memory/1336-0-0x0000000002450000-0x0000000002574000-memory.dmp

Filesize
1.1MB

Download
memory/1336-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1336-2-0x0000000002450000-0x0000000002574000-memory.dmp

Filesize
1.1MB

Download