1b28fafbf6968d7444246e695619dae4a4f3ef7e7423a6f54b7f63e851bfb86c

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 23:50

Target

327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe
Size

205KB
MD5

327efbbc051498f0f14dd2f8ea647229
SHA1

91f36208b45934bdb2f1df9242900805b433fccb
SHA256

1b28fafbf6968d7444246e695619dae4a4f3ef7e7423a6f54b7f63e851bfb86c
SHA512

db7406b3ee45804e72bf2a528fec8131de1640fca73371c399cc8ba357c88a7d48fb7cf2585a2a1aa2948f3d72c5073212a36deb96395bb695f635f48d797839
SSDEEP

6144:bvzcnSq3ZwbBEE+tOidQZchMxMtljwkSJ:/ESqJwbBEE+tOi8c2xwlqJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1420	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2308	1420	327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe	31
PID 1420 wrote to memory of 2308	1420	327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe	31
PID 1420 wrote to memory of 2308	1420	327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe	31
PID 1420 wrote to memory of 2308	1420	327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\327efbbc051498f0f14dd2f8ea647229_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 136
  2⤵
  - Program crash
  PID:2308

memory/1420-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download