fad50006c73ffb6ccdd22613fc4117b3ccf60f111dffafe36de766c32f6ac82d

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 07:58

Target

153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe
Size

3.0MB
MD5

153d0dc19210244bbe0c9450be7009f7
SHA1

63dcef968d9e59220b9f74bc925461b2e365e3bb
SHA256

fad50006c73ffb6ccdd22613fc4117b3ccf60f111dffafe36de766c32f6ac82d
SHA512

7a3a453527693ba7a79b5701e7a6f086ada525ef1f1a2ade1a47185e56116fc928ea5c31340293c8a28d58543cf259ba19ff1f391fc7997126d176acd4eba3b6
SSDEEP

49152:amBoaCBQUWz1vY1RXgaEwGkFT4Wk+uUwWAOwFL/Y+McDEVgCvudAJyCILUK0e:aOCBQUq1vY1uaxfeWkt/OmVZDogCGyuZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	2960	WerFault.exe	27

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2036	2960	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2036	2960	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2036	2960	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2036	2960	153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\153d0dc19210244bbe0c9450be7009f7_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 300
  2⤵
  - Program crash
  PID:2036

memory/2960-0-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/2960-1-0x0000000000310000-0x000000000033C000-memory.dmp

Filesize
176KB

Download
memory/2960-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2960-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2960-4-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2960-5-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2960-9-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2960-8-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2960-7-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-10-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/2960-11-0x0000000000310000-0x000000000033C000-memory.dmp

Filesize
176KB

Download
memory/2960-13-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download