cc6daa2fd6dbda07c900725d566ff55719ff6d6559b4429d6832e63b46435183

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 02:09

Target

2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe
Size

28KB
MD5

2a9ef67e4a4739fc71fb5583dc41e3f1
SHA1

e5524e3e369a11c9ca5ed38d5a9eab33640afab6
SHA256

cc6daa2fd6dbda07c900725d566ff55719ff6d6559b4429d6832e63b46435183
SHA512

7d8a86a79dd1ef809a9b1d66370b3dd799d723faedc07acc61ce63b264e562ef7790982ce276c83111d8715af874b30c4785c554732b6b0d0feff263f6d8bed6
SSDEEP

768:xHeyrHEyp69sHD+M2Y/LSRntFGweaO8JR:RrHEyp69sHD1Z/mleiJR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2520	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3068	2520	2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3068	2520	2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3068	2520	2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3068	2520	2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a9ef67e4a4739fc71fb5583dc41e3f1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 100
  2⤵
  - Program crash
  PID:3068

memory/2520-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2520-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download