5314e49141fe782b39ff04073b9010df41a41044049905fca38778269a277926

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 15:38

Target

168dc499525ec923418b9276d1465123_JaffaCakes118.exe
Size

45KB
MD5

168dc499525ec923418b9276d1465123
SHA1

5e3652b3d963b0dd88a3122215effd66717981c2
SHA256

5314e49141fe782b39ff04073b9010df41a41044049905fca38778269a277926
SHA512

7ae960fb7cc410abadcc9e6fba4ee598a8d17e411b0b62a7d6c4d3edbc6c557312de7388cc81c4a6f918316543fea5ce351cfb5f40b4552bde2351209bfa3bc9
SSDEEP

768:V1MgH9AUwyEeu3PBgqHgyH80EhoYHp4584gzWJuPXgG36Xyf8C0g:XttwyE/BVHgqCK8aJu/KXyf90g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2500	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2056	2500	168dc499525ec923418b9276d1465123_JaffaCakes118.exe	28
PID 2500 wrote to memory of 2056	2500	168dc499525ec923418b9276d1465123_JaffaCakes118.exe	28
PID 2500 wrote to memory of 2056	2500	168dc499525ec923418b9276d1465123_JaffaCakes118.exe	28
PID 2500 wrote to memory of 2056	2500	168dc499525ec923418b9276d1465123_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\168dc499525ec923418b9276d1465123_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\168dc499525ec923418b9276d1465123_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 152
  2⤵
  - Program crash
  PID:2056

memory/2500-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2500-1-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/2500-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download