9078ad0336f0c911008da25dd1ce16e0c9f1b5bc177a4d5d6dcba8714dcf1fa7

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 10:06

Target

97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe
Size

367KB
MD5

97d293c8850806c30e191e5f13704f85
SHA1

92be1fab0fa8c79551994aa77fcd460b43305da0
SHA256

9078ad0336f0c911008da25dd1ce16e0c9f1b5bc177a4d5d6dcba8714dcf1fa7
SHA512

5e970d1821b8d1006cdee46c8f41770e4a81f20f2932b6ebdb0718916b0cedd7f3bd03128471eaf64a41ef0a725b77b400972191569c0f55f0077a4cb2fca19f
SSDEEP

6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+N8:rTAOm5eyUnJmCzAXTzJR3RvK6lCwN8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2804	2940	97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2804	2940	97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2804	2940	97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe	28
PID 2940 wrote to memory of 2804	2940	97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 116
  2⤵
  - Program crash
  PID:2804

memory/2940-0-0x0000000000850000-0x00000000008B0000-memory.dmp

Filesize
384KB

Download