f21f3fd0dc34e40bab1ebbea0dfe1334190838faad7cc67df7cb85d03c2a7ef0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 21:51

Target

6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe
Size

437KB
MD5

6c60b309bc130eea9ad28a5fcd991908
SHA1

ac6fea449e48f523d80830d163075a7fdb934d86
SHA256

f21f3fd0dc34e40bab1ebbea0dfe1334190838faad7cc67df7cb85d03c2a7ef0
SHA512

d3f490c45c52269224bb97049d84ba52405316c2dfc4dc02d21b7dfd5dfdd5be0d49bf658587848cbfa30b2af5b70eb5a127e65a21bd926755d76c0e5bb9dd8d
SSDEEP

12288:Z9Z8m5DuEy2f+73v3m0/HkWRpsslw9rVb:Z9Z8mPrm73n/nNlw9rVb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	1580	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3004	1580	6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe	28
PID 1580 wrote to memory of 3004	1580	6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe	28
PID 1580 wrote to memory of 3004	1580	6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe	28
PID 1580 wrote to memory of 3004	1580	6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c60b309bc130eea9ad28a5fcd991908_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 116
  2⤵
  - Program crash
  PID:3004

memory/1580-0-0x0000000000ED0000-0x0000000000F41000-memory.dmp

Filesize
452KB

Download