1cd6f525bdaefe53f0b9a0768cbe8dbdb34064dfa511d38ff459ac5f3ebf4d92

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 19:03

Target

236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe
Size

53KB
MD5

236d8c6ddb5c187eba33d70e46a70f47
SHA1

b3f6a463bd04319f7fc58d910e90fd4a5c266bbb
SHA256

1cd6f525bdaefe53f0b9a0768cbe8dbdb34064dfa511d38ff459ac5f3ebf4d92
SHA512

e91f48da59d0f317793f844d782d31c11df0cbe0f92ec5aea951417f5b3135389c3725fefc5f31b9362e1edf813ffa15da3758f079d2abd43619de0a9a406bdf
SSDEEP

192:l4nTtZu9o1wP9g/Gg8QzDF4892U++05i+CcwnJzgVnbroC/HQL+HE:OnT+oq9gXpe8UPU+4Mfn/6+k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1148	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2052	1148	236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe	28
PID 1148 wrote to memory of 2052	1148	236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe	28
PID 1148 wrote to memory of 2052	1148	236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe	28
PID 1148 wrote to memory of 2052	1148	236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\236d8c6ddb5c187eba33d70e46a70f47_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 148
  2⤵
  - Program crash
  PID:2052

memory/1148-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1148-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download