5c5ecd0b884b60cab634617bf5480a8210ddc4d74dd5463bd73432753b93c13d

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 04:09

Target

14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe
Size

987KB
MD5

14a0e2f429c02578341a593056cc3410
SHA1

66fc121652467428797b5acef9f8c88b7c01aa70
SHA256

5c5ecd0b884b60cab634617bf5480a8210ddc4d74dd5463bd73432753b93c13d
SHA512

118caacbc350d570e94879b6a1a3bb426d2b253667e6c8220931c1ed5a3ead99c19377f8701541f9bb2fe40bcce3a6e1bb803d2847eb4f1ea116dc0981e5e9c4
SSDEEP

24576:QW16c//////xWaTDVIPhquYWwJn0JP3amd3x94WwJeMjJHtNBczqzU:bsc//////xlTDuJqu+n0LbCHWzq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
936	2372	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 936	2372	14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe	28
PID 2372 wrote to memory of 936	2372	14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe	28
PID 2372 wrote to memory of 936	2372	14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe	28
PID 2372 wrote to memory of 936	2372	14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14a0e2f429c02578341a593056cc3410_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 188
  2⤵
  - Program crash
  PID:936

memory/2372-0-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download