9ec4c824dce60d5fa1700351ac9b6dc262bbe53b043fea35bf2f023a88ef965d

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 15:57

Target

169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe
Size

398KB
MD5

169c49e3125dfd90393d21bf25bab235
SHA1

754a72515805728a0aedd46539714100d25fa345
SHA256

9ec4c824dce60d5fa1700351ac9b6dc262bbe53b043fea35bf2f023a88ef965d
SHA512

4a2c21c3ed1ed2aa7311e25113a5fb88c232d2db87aea30a768743c00150466c7568ec5af62982e95576f1e0e36dd5dc14c153d9c82b36d98c55370ba0f4fac7
SSDEEP

12288:W7bwhVxnhZap+xUTvAolt4CnQf1pieoSx:WnAnhZasGAol9Q9Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1924	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1612	1924	169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe	28
PID 1924 wrote to memory of 1612	1924	169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe	28
PID 1924 wrote to memory of 1612	1924	169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe	28
PID 1924 wrote to memory of 1612	1924	169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\169c49e3125dfd90393d21bf25bab235_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 192
  2⤵
  - Program crash
  PID:1612

memory/1924-0-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1924-1-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download