2ed90e574e5f3435fc5a8fe57dc43c0fc0361eb841cfcb7c9ce2057cc72f486b

Analysis

max time kernel
140s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:07

Target

2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe
Size

526KB
MD5

2c48b5fb61642d445b549c0bad1ae6b4
SHA1

cfc262d57baaf116a4eceb22e543bd90699b6aa7
SHA256

2ed90e574e5f3435fc5a8fe57dc43c0fc0361eb841cfcb7c9ce2057cc72f486b
SHA512

79f5f51768ac9de2e6efaf9cca15d38ed7bee0f011c0a623c24e6416b8b56f2f6e0e60f40cc941cb6d7c123408b5748c9bd81ccdf04a1cc7572a27608aacfb03
SSDEEP

12288:e1iHHDzyWrkIheeHCVxdA6nIWG/U8aimwSiNjJELbwQP1j:ESjzNfeeHmBIWWUi6PwQP1j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	2540	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1072	2540	2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1072	2540	2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1072	2540	2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1072	2540	2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c48b5fb61642d445b549c0bad1ae6b4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
  2⤵
  - Program crash
  PID:1072

memory/2540-0-0x0000000010000000-0x00000000101CF000-memory.dmp

Filesize
1.8MB

Download