f067d0d371b0adaec5aba40e7d38b433fa3031dde64e8766906ed24b0c0b53e3

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 12:10

Target

8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe
Size

428KB
MD5

8a716deb219137c2ef3ba23fb59540b1
SHA1

8ba013d360f4779bbb6e708182cda95ff54fa9cc
SHA256

f067d0d371b0adaec5aba40e7d38b433fa3031dde64e8766906ed24b0c0b53e3
SHA512

046d1c5f8ae622c5222faafa67dea315d43ea3abc8f44955cc81f138967cfde083c8f54ec3b428a4f9e8152adcd7cc05bfe9103acad2c92e2c53f525987986cb
SSDEEP

6144:mYbWW2WDmyUUqK5EhEMDMg48Td50WKtNvGRNxw8QUjwM:mhWjmyUUqK5j030TyNC8Q5M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	316	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1916	316	8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe	28
PID 316 wrote to memory of 1916	316	8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe	28
PID 316 wrote to memory of 1916	316	8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe	28
PID 316 wrote to memory of 1916	316	8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a716deb219137c2ef3ba23fb59540b1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 116
  2⤵
  - Program crash
  PID:1916

memory/316-0-0x00000000001E0000-0x0000000000250000-memory.dmp

Filesize
448KB

Download