808cedbb027e09e9a0240c7460bb479a2405604bb46058f9e3e13813153af66d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 08:23

Target

2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe
Size

20KB
MD5

2543dbabe542a801dd370dee137171d8
SHA1

549412e82be3297884c0364092934eb7dfec043c
SHA256

808cedbb027e09e9a0240c7460bb479a2405604bb46058f9e3e13813153af66d
SHA512

ac6d43af545da42004dde777dcd0a15214f06fc719995e6517f8853c1fa32cde66791e7012d68f8228415acaf7f04267af2c47b77f7982144ad1f192a8da0965
SSDEEP

384:tsYAexXWNxGlNS8C4l9e/+0yDV0MSKvrjPng8VII:eehWxEEHm9e/+duMtrr1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2952	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2968	2952	2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe	28
PID 2952 wrote to memory of 2968	2952	2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe	28
PID 2952 wrote to memory of 2968	2952	2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe	28
PID 2952 wrote to memory of 2968	2952	2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2543dbabe542a801dd370dee137171d8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 88
  2⤵
  - Program crash
  PID:2968

memory/2952-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download