178c43bc50f1c0a2159740359e969d1315f1a59e153373acd7b114e3c0c157ae

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 17:46

Target

290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe
Size

89KB
MD5

290df81372a99bf05d7a5d5e79e610fe
SHA1

57a342747d40ca919fcdafa643fa48a9cdbced8d
SHA256

178c43bc50f1c0a2159740359e969d1315f1a59e153373acd7b114e3c0c157ae
SHA512

ca74c7b8c2f102dc7baab5a8446122039abf89cc7b7d281f1a808dd853e49d4d5908dccede83939a411d8a6b0b748e3a81ce04664de896ef9278c3a21cf260b9
SSDEEP

1536:8mN6y7Dy3+aVU9w1fcan/cLKggI41JXeOmVy2YmEBtipNlVCdyQr1XoMJh/7DmW9:8zSgByb/gICXg1YmOtiFVOyKocleW0EH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2556	3012	290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2556	3012	290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2556	3012	290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe	28
PID 3012 wrote to memory of 2556	3012	290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\290df81372a99bf05d7a5d5e79e610fe_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 180
  2⤵
  - Program crash
  PID:2556

memory/3012-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3012-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download