55511597e5b014918a3ee7be5d4e1441af2fbe098b9fbfb119bb87d2c4bd5258

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:13

Target

23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe
Size

650KB
MD5

23cb553ce604959f3d39575813d8d48b
SHA1

5b8bd0e4cb5f268844c25321b24b51b1b31e58d6
SHA256

55511597e5b014918a3ee7be5d4e1441af2fbe098b9fbfb119bb87d2c4bd5258
SHA512

2e41e305b3ee1a945cc234799582619015778ed140de5ccf3d2e44dc7c7fe93ccf13f854d7d47aa0f98871de6738e57b9bd65bc347ae740c53234e1c5121ec6e
SSDEEP

12288:59m7jyY2XQJ6BwMiovJuI3nrfFyOdyjvTBT97HmoiqtFolf+g6Y3Va:uuLOFLovZ3nrMIULBTpHliqtm3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2480	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2264	2480	23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23cb553ce604959f3d39575813d8d48b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 36
  2⤵
  - Program crash
  PID:2264

memory/2480-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download