ea7053d5446afe1b8c80ef4fad2f70f87a91998d8c3e41dc725519614db2a55c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 20:15

Target

9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe
Size

321KB
MD5

9921e7dec69570936358c6865d2416ab
SHA1

fc983cc4ddd6fde80b9a7f384f42f890ddb463cf
SHA256

ea7053d5446afe1b8c80ef4fad2f70f87a91998d8c3e41dc725519614db2a55c
SHA512

499848722e4bf1d68c6b48dc880875faf8aa2ddaff27549b0d51be8b1ab5cf563c6962121e3a2cb2da8abacee211da18644246d69c2cba29ba226eccb0a8d47b
SSDEEP

6144:rNxa/EJddK7vwK1poH7td/tQqG56Prd3Z5NBA3r12Ii:rO/YddK7vw0oHprG5+3a7O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1432	1252	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1432	1252	9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe	28
PID 1252 wrote to memory of 1432	1252	9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe	28
PID 1252 wrote to memory of 1432	1252	9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe	28
PID 1252 wrote to memory of 1432	1252	9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9921e7dec69570936358c6865d2416ab_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 116
  2⤵
  - Program crash
  PID:1432

memory/1252-0-0x0000000000DB0000-0x0000000000E05000-memory.dmp

Filesize
340KB

Download