131eaa90438d8024ecb082d7d8726092d9a84e344f0c48308074fbd574183270

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 09:23

Target

199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe
Size

292KB
MD5

199c001c1827a95c4f9a308e289a3eab
SHA1

1155d8040fd12066833d074f56c566248474226c
SHA256

131eaa90438d8024ecb082d7d8726092d9a84e344f0c48308074fbd574183270
SHA512

cfee246041333bac6226bf67caed37d7a8c2e1fe8e59eb0d3bfcc3b78d378eeae8e2d1517889eac2860717dc887dde6673dfeaea5acf7c8f20187f1be13e6c36
SSDEEP

6144:IupSEtfrfVpmD/R8BAWJhfgn3CbrSW1bBxqMdL4TGH8AnZV:NRfwbRpWJ2nyXV1bjqMZMa8kV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1840	2908	199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe	28
PID 2908 wrote to memory of 1840	2908	199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe	28
PID 2908 wrote to memory of 1840	2908	199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe	28
PID 2908 wrote to memory of 1840	2908	199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\199c001c1827a95c4f9a308e289a3eab_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 124
  2⤵
  - Program crash
  PID:1840

memory/2908-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2908-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2908-2-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download