7a2b5416d72ea19130ee72cb810f5f42026e7f45f726ae79662fa568e8b9b7f1

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 13:56

Target

1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe
Size

98KB
MD5

1a613a123c3627d547adc63de929dd6d
SHA1

6318a5826188302d1b1b8e6901b9680abdabf2db
SHA256

7a2b5416d72ea19130ee72cb810f5f42026e7f45f726ae79662fa568e8b9b7f1
SHA512

94c7e0adcb77794b8b74ec2d8fd149e62241d6921d3055b6ca4b3d7e3ae65151342f11362f2e13d93b30f700dd88cbf5d8f4b3f68721b071a26adb397aa4fe2d
SSDEEP

768:/0eT/anJ9G8Ferhh7HBg+kzhN9J2w5IZ5J7MmaSPMCpRbKWMM/:+nJdFerhXq9Jb5IZ5J79BPMCbGjS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
932	4828	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 968	4828	1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe	81
PID 4828 wrote to memory of 968	4828	1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe	81
PID 4828 wrote to memory of 968	4828	1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1a613a123c3627d547adc63de929dd6d_JaffaCakes118.exe"
  2⤵
  PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 412
  2⤵
  - Program crash
  PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4828 -ip 4828
1⤵
PID:2648

memory/4828-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download