491b03f5f8164a123d67b75f37046858b3dc8353424a4a728e4a58bfd6deea45

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 22:17

Target

0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe
Size

1.8MB
MD5

0aeb1bf17f9b2b69f4274ffeff89255f
SHA1

0e4197d5f26c9b6ec993455ad96d5f5b219438e0
SHA256

491b03f5f8164a123d67b75f37046858b3dc8353424a4a728e4a58bfd6deea45
SHA512

fd65c3546c4a456e740997faf68d0b7a9aa593afcfa04e6f553c630feda4f8a9f663890b76e4851f9298158bfd178132bf9dc740284bff5b06b9957f0acde8f1
SSDEEP

49152:r2EeKqxExKGg3KNM9fo4SDD1ThutAnXl19Gge3rkCV9zXt:r2EeVaxK7yM2DXutAwXf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	3056	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2712	3056	0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe	28
PID 3056 wrote to memory of 2712	3056	0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe	28
PID 3056 wrote to memory of 2712	3056	0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe	28
PID 3056 wrote to memory of 2712	3056	0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aeb1bf17f9b2b69f4274ffeff89255f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 280
  2⤵
  - Program crash
  PID:2712

memory/3056-0-0x0000000010001000-0x0000000010067000-memory.dmp

Filesize
408KB

Download
memory/3056-1-0x0000000010000000-0x00000000103CD000-memory.dmp

Filesize
3.8MB

Download