d20d9cf9a9fa86c0fd224ae4c01289915de88b0b2123192aef45beedee65984b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 04:46

Target

acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe
Size

332KB
MD5

acecbc00532b3c8cd35357ce7a68d6fb
SHA1

e64dbe4f1fdd0e22d731b2d7e9d5e31a4360fe71
SHA256

d20d9cf9a9fa86c0fd224ae4c01289915de88b0b2123192aef45beedee65984b
SHA512

940eb5149aaeb41b2548b0270bc453a20f692b1c44e9afc2e55a63861c4a1c0331012168b6d3edf1be924ba4c08364536f8cbe65e04f8817569122c8f633a1f2
SSDEEP

6144:JbQFDTnX7J1KusybU+bBZFzWzxCqeU4yMFMsRnbOHDMSizlNd6kn3xHOY0A:JbQFDTnXbsyb5lZFyx6MsJiDMS9HY0A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3064	2960	acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe	28
PID 2960 wrote to memory of 3064	2960	acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe	28
PID 2960 wrote to memory of 3064	2960	acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe	28
PID 2960 wrote to memory of 3064	2960	acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acecbc00532b3c8cd35357ce7a68d6fb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 152
  2⤵
  - Program crash
  PID:3064

memory/2960-0-0x0000000000350000-0x00000000003A6000-memory.dmp

Filesize
344KB

Download