7975eb5be849be2844a5d843a076045823837a7bebe1e0f5dc84ec324b47e0e2

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 05:13

Target

0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe
Size

223KB
MD5

0cb87f707fd5fb08f2a9be34f5444d89
SHA1

109d120dcf95fa5c533afa87baf772ef872926d5
SHA256

7975eb5be849be2844a5d843a076045823837a7bebe1e0f5dc84ec324b47e0e2
SHA512

cae60a44c4449652457c604b081218dff7fde6700082f7530ffd987360b94022828bedd0216f0fdb5a115a559f44d2c0bae78d1a691079d16947df7578323f6e
SSDEEP

6144:9+fKfLYsxUvBuYfKx/8GcsMBvMCmJpQ8Z7:9Pf8QQ3+esTCmN7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2524	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2952	2524	0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2952	2524	0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2952	2524	0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe	28
PID 2524 wrote to memory of 2952	2524	0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cb87f707fd5fb08f2a9be34f5444d89_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 252
  2⤵
  - Program crash
  PID:2952

memory/2524-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2524-1-0x00000000002F0000-0x0000000000332000-memory.dmp

Filesize
264KB

Download
memory/2524-2-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2524-4-0x00000000002F0000-0x0000000000332000-memory.dmp

Filesize
264KB

Download