ab5813481545a55febe94379a9a036e13e488cb31e2b55320dc10712f7d1af88

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:18

Target

08257e2fae33faa536910dc610900c47_JaffaCakes118.exe
Size

49KB
MD5

08257e2fae33faa536910dc610900c47
SHA1

adcd7e6992a2b74dc985277b4c255e6f2702bf4a
SHA256

ab5813481545a55febe94379a9a036e13e488cb31e2b55320dc10712f7d1af88
SHA512

7de206ff9a2d64ad148850a6950de5f3377f71cd30535031a95f725e5325bc141d9d5322f02e6de79fb12f62eadaecff8dc5dbb325c4734e1c78a1f752e35934
SSDEEP

768:+11usDvczngXRtJ7HJ6k2BvClM/BqnHQF0Ixmljk2z1qqKi83VpBee:+usgzngBtJpyBwM/oQ0E6Jaig

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	2196	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1676	2196	08257e2fae33faa536910dc610900c47_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1676	2196	08257e2fae33faa536910dc610900c47_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1676	2196	08257e2fae33faa536910dc610900c47_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1676	2196	08257e2fae33faa536910dc610900c47_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\08257e2fae33faa536910dc610900c47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08257e2fae33faa536910dc610900c47_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 44
  2⤵
  - Program crash
  PID:1676

memory/2196-0-0x0000000000400000-0x0000000000422700-memory.dmp

Filesize
137KB

Download