60db043979dd2d8d78d9ed0d9d7d4b835d0c84863833dc514b18bc0587ac588d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 15:29

Target

0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe
Size

125KB
MD5

0e95748d5ff1502f4620314ade2bf366
SHA1

8c5822c2172ff5a29c81e73a30d70498459ae563
SHA256

60db043979dd2d8d78d9ed0d9d7d4b835d0c84863833dc514b18bc0587ac588d
SHA512

db1d8f59a8e64eb7ac244a6a0948a213c3e7daedfe4b74080fef48df583fb69f980d8a7b5487a8b1657e438daaab4dadf7e40fc6482de55e77007457fc23bbfc
SSDEEP

3072:bJn/qsTsZoW2aP+Yh0yXZeSoB/JTusSpq95qElNy:bJn/qsTsPP6Jy/GK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	1700	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2400	1700	0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2400	1700	0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2400	1700	0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe	28
PID 1700 wrote to memory of 2400	1700	0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e95748d5ff1502f4620314ade2bf366_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
  2⤵
  - Program crash
  PID:2400

memory/1700-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1700-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download