08ad443f652d8e93fda6ddcc69e8f250f42bffbefb0e7e65f9076f2a67e85c27

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:39

Target

06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe
Size

22KB
MD5

06f33de17de36aa02055c4c9c6f477f6
SHA1

bebddd4968d11528716fb9a6202b2b6ca5950aaa
SHA256

08ad443f652d8e93fda6ddcc69e8f250f42bffbefb0e7e65f9076f2a67e85c27
SHA512

062b62cfe099c2a9d5f1907fada41690d1fb9d0205291df2ee1ca42adde99bd98da4ea2768b713f54b1739162a7b1b21dac1abba4458fe9abac9054282de2435
SSDEEP

384:O2I6JPWqgCWJ1rbEEaKC7S7h4ysFwze1IPGiaBi68lQqM1hBkihrc0V:3gvrwEtCDpIPGiLlQqMjB1h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2940	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1960	2940	06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe	29
PID 2940 wrote to memory of 1960	2940	06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe	29
PID 2940 wrote to memory of 1960	2940	06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe	29
PID 2940 wrote to memory of 1960	2940	06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06f33de17de36aa02055c4c9c6f477f6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 124
  2⤵
  - Program crash
  PID:1960

memory/2940-0-0x0000000001000000-0x000000000101C000-memory.dmp

Filesize
112KB

Download
memory/2940-1-0x0000000001000000-0x000000000101C000-memory.dmp

Filesize
112KB

Download