5bdd30da9dd86b48708e955cb13210adbfdd0467f3379c56ee30b041817011ef

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 08:47

Target

078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe
Size

145KB
MD5

078810f98a24e0b6670572dd995cc45a
SHA1

5e2c5a0041c7e0cab80b83f5ccf84977cb97d204
SHA256

5bdd30da9dd86b48708e955cb13210adbfdd0467f3379c56ee30b041817011ef
SHA512

9dce0353d72d74678a234a0e9deffb7535e9348ddc1fa47fdb96cc7cb3e9723476abb33074b805c19e3c8dfe8e1b202826fbea726f6efe26102e2704d16e8d58
SSDEEP

768:rAljE5n8/bn+Kwhlr8HnxhW5sk1U/58lmmmbeskhx8Hvc5gI0m04F4C9F5nO4rGZ:N5neEhlcTW5sk1U/5ds5gFQVgd54vjO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1744	1952	078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe	28
PID 1952 wrote to memory of 1744	1952	078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe	28
PID 1952 wrote to memory of 1744	1952	078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe	28
PID 1952 wrote to memory of 1744	1952	078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\078810f98a24e0b6670572dd995cc45a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 36
  2⤵
  - Program crash
  PID:1744

memory/1952-0-0x0000000001000000-0x0000000001041000-memory.dmp

Filesize
260KB

Download