e26f7399707a1f7503f8899a539ef6bb77121608d70a1dc2ed3f7cb8def85360

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 14:07

Target
846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe
Size 423KB
Sample240530-reybcacc52
SHA256 e26f7399707a1f7503f8899a539ef6bb77121608d70a1dc2ed3f7cb8def85360
MD5 846a13176e8baf2b4da2230b063bccda
SHA1 56e1a057eb30ac37f0c3c1ec7a5be1ce4dc27654
SHA512 a3f186b1cb74e4f5c52cd749bd3f6403bec7b53753954767ce39339d6e3de735a6333f3aab19210f9139b926d1f1b87ed13d1916ff1850a03097bce19c1bab17
SSDEEP 12288:ysHIB7QkKRaug8yeikCykaAOl13l0Pz8MBqIuM:ysHU7+h5yeilykkln0PzZBqIF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1744	2040	846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1744	2040	846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1744	2040	846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe	28
PID 2040 wrote to memory of 1744	2040	846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\846a13176e8baf2b4da2230b063bccda_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 116
  2⤵
  - Program crash
  PID:1744

memory/2040-0-0x0000000000D80000-0x0000000000DED000-memory.dmp

Download