e24872029b4dd8aa145b7e3ff444ad8961ccddb9d674406127b103bcbd5d63c5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:57

Target
91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe
Size 430KB
Sample240603-p7ch8sgf45
SHA256 e24872029b4dd8aa145b7e3ff444ad8961ccddb9d674406127b103bcbd5d63c5
MD5 91de7421147a11922f26ef1fae81d740
SHA1 0e710725143668eed8b153fc6c427663c4440883
SHA512 4d5ffc8a9df9fd9ff38146fbffb37968ee94e416dbdb83ef76c55d03d5d0a7e7dcf7246db94615fc5fc094da9611ab631b1f8dd504f994859e7854bf98412653
SSDEEP 6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1252	2448	91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe	28
PID 2448 wrote to memory of 1252	2448	91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe	28
PID 2448 wrote to memory of 1252	2448	91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe	28
PID 2448 wrote to memory of 1252	2448	91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91de7421147a11922f26ef1fae81d740_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 116
  2⤵
  - Program crash
  PID:1252

memory/2448-0-0x0000000000260000-0x00000000002D0000-memory.dmp

Download