2dce3210c0ddee4a45aae967493de16b00b7f5d3f1822d2c29b0588880a5a2bb

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 00:06

Target

0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe
Size

147KB
MD5

0b6cca5a563407a6cc65a25ec7063e73
SHA1

405d72eef3ef5e1ad7e2b4ee7f7031c84a1b8712
SHA256

2dce3210c0ddee4a45aae967493de16b00b7f5d3f1822d2c29b0588880a5a2bb
SHA512

e3271d0c18705947880673b7a820b02c694eb45c128f8cab4ee3a5e34c73c69b99815f7e8751969caf220a6ab168d41e12a91f9cfff03f70457d5566cab29382
SSDEEP

3072:i3bVrhbdOGYgW/oPLZ96HM0XU+aDe5UEjmIlmJ:AbbdOOHn+aC1mJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2804	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2100	2804	0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2100	2804	0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2100	2804	0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2100	2804	0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b6cca5a563407a6cc65a25ec7063e73_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 148
  2⤵
  - Program crash
  PID:2100

memory/2804-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2804-1-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download