2be5d82c16ef5369e8cb91f1745d72ffc076f0dd66efb271c9344ab1fbde4c72

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 03:08

Target

20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe
Size

56KB
MD5

20e1a80ba4e7cf1e3a08b5fe0a731074
SHA1

57b3f6b7ce9dcc232b63a27490fe940e33f20390
SHA256

2be5d82c16ef5369e8cb91f1745d72ffc076f0dd66efb271c9344ab1fbde4c72
SHA512

0c3a6d8a3d4546db31924239a219ec13aa38269bf814fb73b107ba1ead8e3abf2a7b311d92f6a819d1752e11a3561682c3184d36236f7bdbb187a57725f64e36
SSDEEP

1536:7mJahS2D8HOXlXsX3XnkcUckD98kMEk7l:6J72yzkcUckD98kMEi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	1244	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2124	1244	20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2124	1244	20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2124	1244	20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe	28
PID 1244 wrote to memory of 2124	1244	20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20e1a80ba4e7cf1e3a08b5fe0a731074_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 148
  2⤵
  - Program crash
  PID:2124

memory/1244-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download