c9b401ca837bf740c77a860ef930fa862378f1ecee65ab516af57e0e1313e1ab

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 03:26

Target

0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe
Size

28KB
MD5

0c4952a01ae96b2c7fe5d1c559d27bd1
SHA1

f93062f1bde4c0297a583a122b0a388db15a9a94
SHA256

c9b401ca837bf740c77a860ef930fa862378f1ecee65ab516af57e0e1313e1ab
SHA512

23850521241ccea74a6b9e7d38021960bbbfc3fc66c0a47290bb322beba0a63749cca4ff33007e606d8affc37f1441ca251019a0fd175c8c7cb73e3b080ad66b
SSDEEP

768:sISw+KOEZL+UVCAzLyKBQUhT9HLxouz38wHFMrT3nudz:RROEQ6CohLxoSM+FM/XCz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2984	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3004	2984	0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe	28
PID 2984 wrote to memory of 3004	2984	0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c4952a01ae96b2c7fe5d1c559d27bd1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 44
  2⤵
  - Program crash
  PID:3004

memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download