42bdcf32d5dc255904025f1f025760bdb0f6c6d0dfcb4226eaca9d690b8db62a

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:09

Target

696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
Size

391KB
MD5

696714abf3989e5291d2fd8f1845a756
SHA1

220b728deefa4d9dd56235c33045c48384e0ef4d
SHA256

42bdcf32d5dc255904025f1f025760bdb0f6c6d0dfcb4226eaca9d690b8db62a
SHA512

bfb0cb7260228dc4d53ef4b95e1bf9cf9ffe2a0bb8766d30f000ec1c255ee8bd0c66708d19397f7b4b0868de9784076d10dcae3f9b477a2224124163aa3ce4db
SSDEEP

12288:sHQjY2RDh62hvCfphW2AoG61ko3YBpA8M:sHQjRRDh62hf2Af6SoIBpr

Score

7^/10

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1536 2104 WerFault.exe 696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe

pid	pid_target	process	target process
1536	2104	WerFault.exe	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe

description	pid	process	target process
PID 2104 wrote to memory of 1536	2104	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe	WerFault.exe
PID 2104 wrote to memory of 1536	2104	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe	WerFault.exe
PID 2104 wrote to memory of 1536	2104	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe	WerFault.exe
PID 2104 wrote to memory of 1536	2104	696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\696714abf3989e5291d2fd8f1845a756_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 376
2⤵
- Program crash
PID:1536

memory/2104-1-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/2104-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2104-6-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-7-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-8-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/2104-9-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2104-11-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2104-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download