15a1c0e25986225d52e4ff0c437ae764fd84fec06fed8cc7d507255c9e2528ae

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:38

Target

22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe
Size

438KB
MD5

22897b2e2e6a9ff26ad30447d2238113
SHA1

009b2decf09d6c0b2ce6e056ac8624957eb8cfd8
SHA256

15a1c0e25986225d52e4ff0c437ae764fd84fec06fed8cc7d507255c9e2528ae
SHA512

bc5736a891dd613048117ad5cee471e40d179cfb04b59811bf07d258dcc43885f739b208e4f8d6de2522a52f7f7815c2cdf1f3750fe6b84dbe6824a5e24366bb
SSDEEP

6144:5pOA+3JNgxCYXADidDSoRyny1oEB02oWYsLxlH1CMX/D751LmZXdi54p2G+Wfmc:p+4CYbNSsyny1PBAuxlVtD751sphfB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	1636	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2180	1636	22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2180	1636	22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2180	1636	22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2180	1636	22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22897b2e2e6a9ff26ad30447d2238113_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 200
  2⤵
  - Program crash
  PID:2180

memory/1636-0-0x0000000000401000-0x000000000044E000-memory.dmp

Filesize
308KB

Download