2bb2946030d1beb9d42c34e264f2edc38f2b76cadc6de4f2dc18eac166cfda8c

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 09:09

Target

21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe
Size

618KB
MD5

21cf297d51b35ec402b588f5ca15ee92
SHA1

020562edb4f8f2a70bad898b51aefdf8f42c4fdf
SHA256

2bb2946030d1beb9d42c34e264f2edc38f2b76cadc6de4f2dc18eac166cfda8c
SHA512

c44baaf26e13077588c4b52671806bad6866e40720b01ce31897a338af0a45069ca2c0cc40eaf74b8d4c4ac6b2c74c61d0d6fdbd17e3458e7a2a6a8a0147be06
SSDEEP

12288:GyJGvFLwUMLvIYrx2ub8IwmMvMFpKIjqijYQ2w0ISL2/ByYx:GyJGvRoLwYJimM0bJqksbISL2/Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2004	2168	21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2004	2168	21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2004	2168	21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2004	2168	21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21cf297d51b35ec402b588f5ca15ee92_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 204
  2⤵
  - Program crash
  PID:2004

memory/2168-0-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2168-1-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download