b727ce4d1c0900aedd82199df5d91ec7b8230e2bb59aa7a4bab5e2e2066c5979

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:47

Target

0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe
Size

123KB
MD5

0df35050ad12d18db4f56c9e1a8fbf3c
SHA1

29119fa53280cfb7c8fd3c595df35d188602e0f5
SHA256

b727ce4d1c0900aedd82199df5d91ec7b8230e2bb59aa7a4bab5e2e2066c5979
SHA512

7bc5eb54b132d3c0c9a4bfc2247d954989d631db33b98f60cd443a22a6c09203c9d6ca2c3d827830a40125a1b836b15ea5164983a6bfbbdec56ff60c6be88024
SSDEEP

3072:yFD9bdGs4c4Szh4TKlbJLf3GFgg+MoBh2aNfRyL6z8j:y59bdGM6TKLf3G2KoXVRyL6Aj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	1232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2120	1232	0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe	28
PID 1232 wrote to memory of 2120	1232	0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe	28
PID 1232 wrote to memory of 2120	1232	0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe	28
PID 1232 wrote to memory of 2120	1232	0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0df35050ad12d18db4f56c9e1a8fbf3c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 36
  2⤵
  - Program crash
  PID:2120

memory/1232-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1232-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download