20d01161556de3d09bcaec397e5d1ff927013a2f6cfd302720d5cee4454db742

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 09:30

Target

a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe
Size

444KB
MD5

a8f9957fa8e36e8578ba182d47f883b8
SHA1

a90d8a1934569089da0297c6df955f6719c39fd6
SHA256

20d01161556de3d09bcaec397e5d1ff927013a2f6cfd302720d5cee4454db742
SHA512

c7439c3165d26ca548411f64bdd1647d16767ba7c3b293964b4ce907b04a762298be978121d67ba769ac232ec6cfd93fb82bdf0aa201e5c9d43708b085cf4c5a
SSDEEP

6144:/6tSLWZgVL3754EUZmfI3z+wGA1oAtZWJP56Pz:CHZ4b754EUZLz+SCA6Pkz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1716	1288	a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1716	1288	a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1716	1288	a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1716	1288	a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a8f9957fa8e36e8578ba182d47f883b8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 120
  2⤵
  - Program crash
  PID:1716

memory/1288-0-0x0000000000B20000-0x0000000000B92000-memory.dmp

Filesize
456KB

Download