2c14a67c1e2bd77869e28d194f44f4ae9231d5083615b61ebeb1ba1c75cc6790

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:51

Target

729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe
Size

487KB
MD5

729ebdd1bde7b322794ddc526a9f32ba
SHA1

aeaacabac9c3c442f7f1c7c6ec62cf4e6d19be2a
SHA256

2c14a67c1e2bd77869e28d194f44f4ae9231d5083615b61ebeb1ba1c75cc6790
SHA512

64c6325db1bfb73bcb96c4c311f3103017c29f565a74d15c0f86e1be7bcacb75442f3a21dd0230f0db9026a4196eabaed1029dbdd69bd7ba1173712ee6b569e3
SSDEEP

12288:IvOos7XPOkGFQ/ujd+GMv9OaVsU86EM4ShhIAy:IvOZ7nGm/Yd+GM1aL6EM3hty

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1228	2040	729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1228	2040	729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1228	2040	729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1228	2040	729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\729ebdd1bde7b322794ddc526a9f32ba_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 116
  2⤵
  - Program crash
  PID:1228

memory/2040-0-0x0000000001390000-0x000000000140E000-memory.dmp

Filesize
504KB

Download