fb89a2b31bdd1d6808245d5cf655fdb30d04fe5728b25738afea68faffbf3b50

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:23

Target

694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe
Size

1.6MB
MD5

694638d40777bdcc580dab29a60a2110
SHA1

d12cf8ff25246d1724103a8d7b26c998c4bd6f5f
SHA256

fb89a2b31bdd1d6808245d5cf655fdb30d04fe5728b25738afea68faffbf3b50
SHA512

56748a270615d508ffdc8e041699acfad234472e47595a3774f68ea669afdaa834670121b4a175d43edd38324bab7aa30020a8517939718a42e53b8e02515085
SSDEEP

24576:kH3xRLx0hwP4V3r+WWpPMrxnJ7zo5yNj:QDVKm4HaMrxnJXx

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 2116 WerFault.exe 694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe

pid	pid_target	process	target process
2156	2116	WerFault.exe	694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe

description	pid	process	target process
PID 2116 wrote to memory of 2156	2116	694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe	WerFault.exe
PID 2116 wrote to memory of 2156	2116	694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe	WerFault.exe
PID 2116 wrote to memory of 2156	2116	694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe	WerFault.exe
PID 2116 wrote to memory of 2156	2116	694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\694638d40777bdcc580dab29a60a2110_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 196
2⤵
- Program crash
PID:2156

memory/2116-0-0x00000000008D0000-0x0000000000A6E000-memory.dmp

Filesize
1.6MB

Download