483d2b75ce8a9d2aeae88fc227bd2dbc68653ddfedc58db74c52aae8adebb378

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 11:45

Target

0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe
Size

346KB
MD5

0852664dddeb761d33c2f918f5e0db28
SHA1

bcbc606bd1cfee2583a9eb1a9f23e79c2a1b85d8
SHA256

483d2b75ce8a9d2aeae88fc227bd2dbc68653ddfedc58db74c52aae8adebb378
SHA512

2277b36f94ab37fd55fc9b8058e5f4e4a0f3f8d3a94a51e8a284c90d128e065b8f3fba4fd35f3c614bbdd9543f34dae519e25b7fa0711dc8e929f2b23eabe65f
SSDEEP

6144:QfxjjUAjspLQkGcj6saQ1/ZMCA56U5otSWT0ERm1YkzO5+p:QfxjjUjDb1hMCAMEnWT0FO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1708	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2180	1708	0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2180	1708	0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2180	1708	0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2180	1708	0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0852664dddeb761d33c2f918f5e0db28_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 560
  2⤵
  - Program crash
  PID:2180

memory/1708-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000000860000-0x00000000008BC000-memory.dmp

Filesize
368KB

Download
memory/1708-2-0x00000000047F0000-0x0000000004854000-memory.dmp

Filesize
400KB

Download
memory/1708-3-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-4-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1708-5-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download