c1feb3116655730c5e463ce014cc3543084f3f8446d79fa6a5c6ecaf2c93c67d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 16:18

Target

28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe
Size

8KB
MD5

28ccf917213cd68a5e29d74c15e36c13
SHA1

1bfd8f70623e1e44d78c18277dc76e2a0c1834d1
SHA256

c1feb3116655730c5e463ce014cc3543084f3f8446d79fa6a5c6ecaf2c93c67d
SHA512

09fdd6cd40da7bd10527ab17258c1bb0c6d451d2dc4b24c551b5d1ff73ff80694c817aa5c7066a9f07bef0367c7f3d4d6cc1d7d80a7e034c34a60af6fd26afb6
SSDEEP

96:DoRa15l4s/xpr2FIBVJW27279WNUoynY/ONfeZEWV4+xF9p:p4U2OUU27wNUoynY2NeT4+vD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	3024	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2360	3024	28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2360	3024	28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2360	3024	28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2360	3024	28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28ccf917213cd68a5e29d74c15e36c13_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 160
  2⤵
  - Program crash
  PID:2360

memory/3024-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download