fe6aa74a45e189a6f4c1dda90962b5afd53c949cbc41e0b69e92828fcaca69df

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 12:58

Target

2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe
Size

63KB
MD5

2272499d181780b6c7ca781487b3ec6a
SHA1

6c9e304f02e2aec4fdbaa2f6973cb0705caa9611
SHA256

fe6aa74a45e189a6f4c1dda90962b5afd53c949cbc41e0b69e92828fcaca69df
SHA512

feb23ca3c1deb598c71519af5a5260f88e710b9555e8e10756b6a4166fac90bbddf19d6c2234ce967cd41e28971e66f98cf1abd40646ad578492445afd37aab4
SSDEEP

1536:v9HwZRtRB6h9py7B6LSTdmD8lHFGR2kt6dr6Aw4iJCwDPVzUva:vW96pkB6EdGR2ktarnniJCUtzH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	1844	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1604	1844	2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1604	1844	2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1604	1844	2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1604	1844	2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2272499d181780b6c7ca781487b3ec6a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 36
  2⤵
  - Program crash
  PID:1604

memory/1844-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download