db6460882ded397e487a042629f04959365c0993dd4127b4f7933cd14b096fc2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 13:52

Target

163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe
Size

37KB
MD5

163d4884bf78c3ce5a1bf7e1493c1b0b
SHA1

c9c1df67811749214d9f3d0a5adcdfc6db379866
SHA256

db6460882ded397e487a042629f04959365c0993dd4127b4f7933cd14b096fc2
SHA512

dff7155961f5733268138672142e18162a084488f71c18c9fb03f517757769dd558a70a0a284c59c70730650afcd8865f43a7a9462b0fbf9d1176c271908dcc4
SSDEEP

768:tjal8nnGZU/tNO/vtKHP+ZZYVvUIj7IH8REIUZwEVX0dX:tm8GZU/tNO/vIPaE9PIFzDQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1632	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1664	1632	163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1664	1632	163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1664	1632	163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe	28
PID 1632 wrote to memory of 1664	1632	163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\163d4884bf78c3ce5a1bf7e1493c1b0b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 36
  2⤵
  - Program crash
  PID:1664

memory/1632-0-0x0000000000400000-0x000000000041824F-memory.dmp

Filesize
96KB

Download
memory/1632-1-0x0000000000400000-0x000000000041824F-memory.dmp

Filesize
96KB

Download