acba05a27f51e9212de595d1bf5e6158550811d77f7cf3bf9ff7e380a32d0273

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:10

Target

079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe
Size

636KB
MD5

079aef2d259fe2d45787c7f00d11a99c
SHA1

38c0f08cb63905e828c4d0632abc33a28e4db97e
SHA256

acba05a27f51e9212de595d1bf5e6158550811d77f7cf3bf9ff7e380a32d0273
SHA512

a48f3291cb4f13f831062f1db352312134fee1cb360a6f62b3aba376437146fe2688ee0af859768128f40a1f0a3688dceb6c057835ecb75c4339f6eeaaff9b84
SSDEEP

12288:N1qgDpicBWHkDdVE3BVF3Z4mxxGbNxNnqA9+LWYxKBQ:NkYbYEHG3QmXVE+LWry

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1940	1660	079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe	28
PID 1660 wrote to memory of 1940	1660	079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe	28
PID 1660 wrote to memory of 1940	1660	079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe	28
PID 1660 wrote to memory of 1940	1660	079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\079aef2d259fe2d45787c7f00d11a99c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 204
  2⤵
  - Program crash
  PID:1940

memory/1660-0-0x0000000000400000-0x000000000051B208-memory.dmp

Filesize
1.1MB

Download
memory/1660-1-0x0000000000400000-0x000000000051B208-memory.dmp

Filesize
1.1MB

Download