06990f8a7a65f33ee46b29e8fca36127e41ee8615abcb1ca6648e6901e9e3db6

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 22:19

Target

23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe
Size

18KB
MD5

23a1c9ab48ee7926b990f991800e0f7e
SHA1

26cdc254a4217f4d3be87c25a387e2e3ce6d06d5
SHA256

06990f8a7a65f33ee46b29e8fca36127e41ee8615abcb1ca6648e6901e9e3db6
SHA512

073e562dd7dca782f99fc5e13aaf10f0be4e547c023d63a0a5a82fc388a9264aca10c0cb6495ff6f46b4e5e7c3f7c4d778133c95e7e8241d184bd26711982eab
SSDEEP

384:9dUu2vDPXPJ3+TkTwzXoL6uQsUuG3KVSKTrrJugLowK/q:su2zXPp+TkTrQs3G3KhfQ8K/q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2792	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2264	2792	23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2264	2792	23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2264	2792	23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2264	2792	23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23a1c9ab48ee7926b990f991800e0f7e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 88
  2⤵
  - Program crash
  PID:2264

memory/2792-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2792-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2792-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download