1b0acb55fcc85d5d5440780fda7153dbd71ff2a7db8bd8514c856b36ef563d56

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:35

Target

6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe
Size

422KB
MD5

6929e6b3e968988fcf3317c19d820e9e
SHA1

22263dfe6932c8463056a84a830fe29f3b13e5ee
SHA256

1b0acb55fcc85d5d5440780fda7153dbd71ff2a7db8bd8514c856b36ef563d56
SHA512

771a5a2db9a5e2cbd45b65a0a77449ca7c5b4d26b9559f8804c2243f10f595726d1cb6ef6c0d01c7e10901c6c7b47e6f09e98bb73d2e5650dd9da00f4e48a302
SSDEEP

12288:ysHIB7QkKRaug8yeikCykaAOl13l0Pz8MBqIW:ysHU7+h5yeilykkln0PzZBqIW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 2988 WerFault.exe 6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe

pid	pid_target	process	target process
2984	2988	WerFault.exe	6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe

description	pid	process	target process
PID 2988 wrote to memory of 2984	2988	6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe	WerFault.exe
PID 2988 wrote to memory of 2984	2988	6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe	WerFault.exe
PID 2988 wrote to memory of 2984	2988	6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe	WerFault.exe
PID 2988 wrote to memory of 2984	2988	6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6929e6b3e968988fcf3317c19d820e9e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 116
2⤵
- Program crash
PID:2984

memory/2988-0-0x0000000000B10000-0x0000000000B7D000-memory.dmp

Filesize
436KB

Download