d95b734fa5c34dc2cbce0fbd3e53737396804ff29b3a6c922da1ffa4b39c3a2c

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:43

Target

27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe
Size

73KB
MD5

27ef4393fcc1691cb71194bc5d1f162e
SHA1

16a618efe1f28656e299b2f9a5e2e8ea012c968c
SHA256

d95b734fa5c34dc2cbce0fbd3e53737396804ff29b3a6c922da1ffa4b39c3a2c
SHA512

f27bf4d7aa9f483d153ffa52a68301af5f709e1ce23bdce2414328f8d5c50b9584bcd301af4df220668d7281fcc735de722f4f4e21ea34f05d891a80b2394473
SSDEEP

1536:utGi9jo+PSb9kuQTjGisjiGWtCsN19tzCR3T3v:I3ouSb9OjGiuhWtCsN19ERjf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2076	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2512	2076	27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2512	2076	27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2512	2076	27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2512	2076	27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27ef4393fcc1691cb71194bc5d1f162e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 96
  2⤵
  - Program crash
  PID:2512

memory/2076-0-0x0000000000400000-0x000000000046F5E6-memory.dmp

Filesize
445KB

Download
memory/2076-1-0x0000000000400000-0x000000000046F5E6-memory.dmp

Filesize
445KB

Download