78d0eb9031da2069c634941aa34f6ed2001918c87876755c81792c8d00049fae

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 07:12

Target

071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe
Size

502KB
MD5

071ec051b29352277fa780d644c2e6d5
SHA1

b34c4468c05af39848dc0edfe106a0bff9614bef
SHA256

78d0eb9031da2069c634941aa34f6ed2001918c87876755c81792c8d00049fae
SHA512

6c1f8e97cfbb3cd1ce5e3abe2ce641cab9fb210e35acf4dd171ce18fa098c49807ea80cf56a52760beec5c0ab69204622f7745e81151157cae898b6a9fb104c8
SSDEEP

6144:JSqjc3HsTaxoqvD2EOK9g2tg7CH9L5d5ezLqIFQSDdABbSbIrx1L1l3ERP:JOyaiqr2Gg7CH9Eq+0BbSox1QP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2096	1860	071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe	28
PID 1860 wrote to memory of 2096	1860	071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\071ec051b29352277fa780d644c2e6d5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 92
  2⤵
  - Program crash
  PID:2096

memory/1860-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download