9e7d753b3db24d08766eae29d33ac3e2f3a78d38000e5f1c32515ee7c5a32296

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 03:39

Target

20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe
Size

9.0MB
MD5

20f5637c1f4117569183e884aab4d0c7
SHA1

22bf3d16bfb7a2b96c1c285a7e0e5667cd98fb0f
SHA256

9e7d753b3db24d08766eae29d33ac3e2f3a78d38000e5f1c32515ee7c5a32296
SHA512

6e07432ff4cb8901ce6f722095ce35523cc94b0dd8199f6e93135ff1507084caa8bb3a6cf4e83a7471d5e14fb6362367b0de40248c11a7e2099965470c3c1071
SSDEEP

98304:sCeisBeLQztuYrwCiHyvD04zARp4hm5dQrm1:sCelwCVi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2352	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2380	2352	20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe	28
PID 2352 wrote to memory of 2380	2352	20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe	28
PID 2352 wrote to memory of 2380	2352	20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe	28
PID 2352 wrote to memory of 2380	2352	20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20f5637c1f4117569183e884aab4d0c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 160
  2⤵
  - Program crash
  PID:2380

memory/2352-1-0x0000000000400000-0x0000000000D70000-memory.dmp

Filesize
9.4MB

Download
memory/2352-2-0x0000000000400000-0x0000000000D70000-memory.dmp

Filesize
9.4MB

Download
memory/2352-0-0x0000000000400000-0x0000000000D70000-memory.dmp

Filesize
9.4MB

Download
memory/2352-4-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2352-3-0x0000000000400000-0x0000000000D70000-memory.dmp

Filesize
9.4MB

Download
memory/2352-5-0x0000000000400000-0x0000000000D70000-memory.dmp

Filesize
9.4MB

Download