fa7f3de64fb90c939bf26314282d70ce72d6c7ecf76864ff2c6105289e804e48

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 23:40

Target

b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe
Size

183KB
MD5

b0b766c569e37a74550ff824c300b2c7
SHA1

cc45c3dbdf5b955b2f8e0a5eef9ccede2227aaf8
SHA256

fa7f3de64fb90c939bf26314282d70ce72d6c7ecf76864ff2c6105289e804e48
SHA512

460f153c810ae08a509af718c2eead335439f6a5d679d0ed8bdfd92ea02b26c190d989c14032cecf0e0e886f9aa84528f064e407d4f55cf18f40032b4ed015bf
SSDEEP

3072:GYqTMd+Z6Ay40mrvG1CM8HwKMlD46NUwdmOoXq4vW9mtdagCHq47/U2pZlN9iAfd:GYqQd7Aa1/8Hwzl1o+gZ2pZEbO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2496	2168	b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2496	2168	b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2496	2168	b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2496	2168	b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0b766c569e37a74550ff824c300b2c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 188
  2⤵
  - Program crash
  PID:2496

memory/2168-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2168-1-0x000000000047C000-0x000000000047D000-memory.dmp

Filesize
4KB

Download
memory/2168-2-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download