6f1ad1628709f22d04611614ed48f80ff051bb1253ca26a3f99d8dabcc828661

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 05:42

Target

b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe
Size

261KB
MD5

b70799c95dd29b4f2d5be5bc7feecf34
SHA1

a5e33928c0c0d69bf70463ba5ec0935f53a941d8
SHA256

6f1ad1628709f22d04611614ed48f80ff051bb1253ca26a3f99d8dabcc828661
SHA512

d17d48045e8298a53e7f5406ebeb91e1425b43b32e9d9445c61d2373f673ee18846287a3d7f6a279d8468e680cf4247f1bb2fee40a2a834d6f0b997d2a77325c
SSDEEP

6144:QinCSbUlS2EqPgZXD3romJDq0orQWau0Vj6he+a9:QinCEpwYD7e0osRHEU/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2120	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1712	2120	b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe	28
PID 2120 wrote to memory of 1712	2120	b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe	28
PID 2120 wrote to memory of 1712	2120	b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe	28
PID 2120 wrote to memory of 1712	2120	b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 304
  2⤵
  - Program crash
  PID:1712

C:\tmp_dbg\dbg_b70799c95dd29b4f2d5be5bc7feecf34_JaffaCakes118.exe_2120.txt

Filesize
742B

MD5
1271bcdce68d51ad389c3a374d10ceb1

SHA1
4b3724cff5f1cb62a0d0fa5c1e8ed721cd6b2aa1

SHA256
ef10cbd4e93b72edaf48b4ec1454a8903424dce8963cccf0953bd9d70deb700b

SHA512
db68697d30cb990b9d97f8f4ed5e1b1a04effe2608f5368bb5e2c56b30dc841ebfdfc34515af0bf87d6ae45e1272e742283b8defef67519553249d76def37e33

Download Submit