5fb5c4e4bb19ccb3828bb8a6442f597127cc98ab80b8255f83d64e651e39bc69

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 06:25

Target

039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe
Size

214KB
MD5

039d2b9331111dd495755bf53fd79c84
SHA1

2aaca0594e82ac657f0ec423f31a8a95bb6f7223
SHA256

5fb5c4e4bb19ccb3828bb8a6442f597127cc98ab80b8255f83d64e651e39bc69
SHA512

3b66613e8aeb182c011ebb444c6fe85870755ca35fb9a5d5f97d9a968bb4a0eaa45120e94d1c5b1b0cb40d79babc5b8b11e760bd3d452822e8f8e45faabe4935
SSDEEP

3072:V3nR7QlrIP2wz4ZxhhOkENk/4HR2SlOrBFmMsrZDufq638WDwY22C:rerIuJZxh6A4x2Sotr2on38r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	2420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 884	2420	039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe	28
PID 2420 wrote to memory of 884	2420	039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe	28
PID 2420 wrote to memory of 884	2420	039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe	28
PID 2420 wrote to memory of 884	2420	039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\039d2b9331111dd495755bf53fd79c84_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 36
  2⤵
  - Program crash
  PID:884

memory/2420-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download