c607ef21fc83a313f2700a295e09ec256160671505f91aaaa301a81498428b17

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 09:24

Target

199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe
Size

65KB
MD5

199cb8e6eb2bb90fda99332c069e74c0
SHA1

41f0fb1a077f13c1b23a507d1017ed852ed26a12
SHA256

c607ef21fc83a313f2700a295e09ec256160671505f91aaaa301a81498428b17
SHA512

58b33dd67f7257fcc04a4966d6546ca12e94bc1c957bc9b81e73b71a6ffefca0482eaa31c25056b6c04becbd12c891a9210bc6fd5af5983050053eb9571c5488
SSDEEP

1536:Qte3KCHs91pmU+q4n++RCMDW4XPxGUl9O:Qt2PMOU+8SXJGUl9O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2928	1988	199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2928	1988	199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2928	1988	199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe	28
PID 1988 wrote to memory of 2928	1988	199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\199cb8e6eb2bb90fda99332c069e74c0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 92
  2⤵
  - Program crash
  PID:2928

memory/1988-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download