cc170195b39c5a3c274f972605092d306a8c8e3e087ae5d39eb0f3db5dea0adc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 07:13

Target

0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe
Size

430KB
MD5

0d2a62afbee70e4593aab58116991842
SHA1

a2bd3486329b92c259c1c5a99669db9bee2e60c0
SHA256

cc170195b39c5a3c274f972605092d306a8c8e3e087ae5d39eb0f3db5dea0adc
SHA512

f7d4bfa08e94f91963786624f5908cd42351bfa4ee1594d4e72abdffcbadbbe82f08c8f0340989a431c5dc2819b534f5884ac937543afe2665364d7b5201bdef
SSDEEP

6144:6pts8P/s28EaaJ92AbvQCKVBzakE7G/XAxb5vSr31RYDrLhCTSgM7/l0g:B8Z8dKEEvQJVBz+1xbh831RYDrcSD/T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2312	992	0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe	28
PID 992 wrote to memory of 2312	992	0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe	28
PID 992 wrote to memory of 2312	992	0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe	28
PID 992 wrote to memory of 2312	992	0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d2a62afbee70e4593aab58116991842_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 196
  2⤵
  - Program crash
  PID:2312

memory/992-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/992-1-0x0000000000401000-0x000000000044C000-memory.dmp

Filesize
300KB

Download