1d15eb34ae4e3df2acb8e7ec145e9df68c1580d17dfc2201adc967af4a1f4155

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 16:26

Target

8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe
Size

422KB
MD5

8eb56d31c6baab5ce61ee3991178fd8c
SHA1

aa5f5b15e60855d336f5efaaa53972ee2b839748
SHA256

1d15eb34ae4e3df2acb8e7ec145e9df68c1580d17dfc2201adc967af4a1f4155
SHA512

0a358d39adf181ba4ee544542876f8c52ad5100f917b834d2ab84d44888f1b904a0a6ed8a9a0d601407a3a15c60ce5703044eb2b09fa0cf160a4db59abadc442
SSDEEP

6144:ykB1INZdWaFzaE7mDGg7Y4+MFyBPys80G5sEOi9Ri9na5UVx3:ykBgdW/E7mDGg8xMkBp80GiZa5UVh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2096	1860	8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8eb56d31c6baab5ce61ee3991178fd8c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 116
  2⤵
  - Program crash
  PID:2096

memory/1860-0-0x0000000000FE0000-0x000000000104E000-memory.dmp

Filesize
440KB

Download