b603c9f991190d6d271362389a564ffa2622c4ee7934ffd8aecf5b9a59a58dbb

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:07

Target

024a358444640c5002e51a075d76f020_JaffaCakes118.exe
Size

190KB
MD5

024a358444640c5002e51a075d76f020
SHA1

5d24d553f27bd5c7e5dc37a303a7e34aba2d3d51
SHA256

b603c9f991190d6d271362389a564ffa2622c4ee7934ffd8aecf5b9a59a58dbb
SHA512

adc8d3a71fd71a8aa2167b8b613a3e24bffd2ea4936aa933a648ac3230da69ee75de6b8b716ba95eff5569bcb91554ca82aab616d995aa126219bceee4775670
SSDEEP

3072:u3/YNSxVkcPNW3y12DcPSK/McFcAGlHkYtTuVsxIeqafFFwWDp4NiIg4ktGgSwIz:0rvbd1TSAqzE8TuaRfFDWN8tYwIrF/FC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	1704	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2600	1704	024a358444640c5002e51a075d76f020_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2600	1704	024a358444640c5002e51a075d76f020_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2600	1704	024a358444640c5002e51a075d76f020_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2600	1704	024a358444640c5002e51a075d76f020_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\024a358444640c5002e51a075d76f020_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\024a358444640c5002e51a075d76f020_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 116
  2⤵
  - Program crash
  PID:2600

memory/1704-0-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/1704-3-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/1704-2-0x00000000004CC000-0x00000000004F9000-memory.dmp

Filesize
180KB

Download
memory/1704-1-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download