11724c0d4668e722614280cd8b38e3390a6df323d794105766fd17541e909b60

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 03:13

Target

20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe
Size

214KB
MD5

20e46e37ee41763fd232abfcf0f282fb
SHA1

dabff3421bb4f57e32b427919c766dcaa8c515a2
SHA256

11724c0d4668e722614280cd8b38e3390a6df323d794105766fd17541e909b60
SHA512

5f04b1db91cd650d96021633decfd1b6ea874cbaa188e2e2eef1f91fe28a2eadd9df2acac6acefe1b04208a160b702edeb0788719b999c2ce55341240510b38d
SSDEEP

6144:zQajbKPBHUh27OQrVjcSI71O5uKJFQv7gYbdathmglUiEwrRq:3bKPBM27DVjXIJIYba0gqwrRq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1544	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1548	1544	20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20e46e37ee41763fd232abfcf0f282fb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 36
  2⤵
  - Program crash
  PID:1548

memory/1544-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download