e5de1c72868fd1d81ede07d0f766e892c7183e8449670dff2319158a3d1862ee

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:11

Target
9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe
Size 367KB
Sample240603-j3gphaaa88
SHA256 e5de1c72868fd1d81ede07d0f766e892c7183e8449670dff2319158a3d1862ee
MD5 9111f6ce907a9d8417d5b91ee011fdb1
SHA1 e9f730730120f5764e61b932605990ceb7997892
SHA512 165c4c463387828f6a481354aa329a2ae439b4a506eddd3d6b13f27f52709099b6ba689517a41af6ec3732c11d23cb13664c307e8fef0163cedd574f1fe29e19
SSDEEP 6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+1:rTAOm5eyUnJmCzAXTzJR3RvK6lCw1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	2284	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1900	2284	9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe	28
PID 2284 wrote to memory of 1900	2284	9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe	28
PID 2284 wrote to memory of 1900	2284	9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe	28
PID 2284 wrote to memory of 1900	2284	9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9111f6ce907a9d8417d5b91ee011fdb1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 116
  2⤵
  - Program crash
  PID:1900

memory/2284-0-0x00000000002B0000-0x0000000000310000-memory.dmp

Download