62e151fe4e9d15009a344618b09477be981d0602a36256185225beb3f6b4272c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 19:43

Target

26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe
Size

119KB
MD5

26080983b351e3326ab3a8d5d78cdbda
SHA1

2da5591635736e47a64e12a38edb6f83bcd9ed3d
SHA256

62e151fe4e9d15009a344618b09477be981d0602a36256185225beb3f6b4272c
SHA512

fc93e93e58e31f6a4e25641e96e929f49c9dccffd6e505d6af61330fafb6b770c474f737657c6e025565cefcead92bf25addc9fad1fd49a0aa155b6d3dc10f2f
SSDEEP

1536:EHySvo762SSct4ileBOcf/4HNZI5ZcCE54B54ct0dmYVSkgYCUktu8a6+39yhoiC:4s7lC30XUI5ZcCE5y1TYvkt6N9ktC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2480	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2264	2480	26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe	28
PID 2480 wrote to memory of 2264	2480	26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26080983b351e3326ab3a8d5d78cdbda_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 36
  2⤵
  - Program crash
  PID:2264

memory/2480-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download