07b6036bcd533bb3236dd465226c71361e4bf9ee394dfa57f08ef421add1e93d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 07:26

Target

251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe
Size

37KB
MD5

251b975e6057e1cb57b4b3877fe4a29f
SHA1

0b37ce89686228a647b404bcd7552f8df75ee9ee
SHA256

07b6036bcd533bb3236dd465226c71361e4bf9ee394dfa57f08ef421add1e93d
SHA512

0502b90214192072a4ca92c38f353cc7d61405da1b1a45539256462f5f00a803847551761ba09c8b8951968a85a5d2057cd7e9d944f24f248d8f4b9134458ba2
SSDEEP

768:S1d21oFPFeODD4ieeurvidJIz4EGMgoY+go8qXx+dC/NC:Ad2SPZ4BeJIEERC7C/NC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
552	1800	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 552	1800	251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe	28
PID 1800 wrote to memory of 552	1800	251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe	28
PID 1800 wrote to memory of 552	1800	251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe	28
PID 1800 wrote to memory of 552	1800	251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\251b975e6057e1cb57b4b3877fe4a29f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 116
  2⤵
  - Program crash
  PID:552

memory/1800-0-0x0000000000400000-0x000000000041F200-memory.dmp

Filesize
124KB

Download
memory/1800-1-0x0000000000400000-0x000000000041F200-memory.dmp

Filesize
124KB

Download