4985940f0d205547dff6244f78bb42fc2b8226b4464156e0546dc5e462d85027

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 07:09

Target

193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe
Size

102KB
MD5

193b8301fa649ce661cdb9dacd8f1747
SHA1

e890a36b7094b0ea7749cae943fd73e3470bcceb
SHA256

4985940f0d205547dff6244f78bb42fc2b8226b4464156e0546dc5e462d85027
SHA512

72dead5843e01aaa9ff1be78b72b27b7a7be44fdb08d0b1af438389c5affc1de2153a0f7e37eb5fe2cd94dab6db51b237bc6dcdb87dee3c6a8917280846d2533
SSDEEP

1536:fCjU6MEUhEdB/YOnOm54nrqdibwn752XpZELGw3Xn94zwCOIJCWkTOoG0lxzE8C0:0UrqdFKHS2wn7s5IH9wTTCWk7lxYTU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1628	1600	193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe	28
PID 1600 wrote to memory of 1628	1600	193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe	28
PID 1600 wrote to memory of 1628	1600	193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe	28
PID 1600 wrote to memory of 1628	1600	193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\193b8301fa649ce661cdb9dacd8f1747_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 36
  2⤵
  - Program crash
  PID:1628

memory/1600-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1600-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download