fdef8225d0c5325e6cb021420ca3060c70531726da4e3a2650d8645a743f674a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:14

Target

32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe
Size

1KB
MD5

32ee91cbd3324abc7a46df4ceda91688
SHA1

9e5fbb6f02ea99f42b949c2e688122d79d3c0b72
SHA256

fdef8225d0c5325e6cb021420ca3060c70531726da4e3a2650d8645a743f674a
SHA512

74682dfec55b0597f42bd01b61a09911ed1fbc83a0bb38d93a1acdf7105d7244e45bb5106730684a2d999e1fa5f187dc5204afd7174d01884318cb0256662e6f

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2660	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2760	WerFault.exe	31

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2660	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	30
PID 668 wrote to memory of 2660	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	30
PID 668 wrote to memory of 2660	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	30
PID 668 wrote to memory of 2660	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	30
PID 668 wrote to memory of 2760	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	31
PID 668 wrote to memory of 2760	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	31
PID 668 wrote to memory of 2760	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	31
PID 668 wrote to memory of 2760	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	31
PID 668 wrote to memory of 2760	668	32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe	31
PID 2760 wrote to memory of 2796	2760	svchost.exe	33
PID 2760 wrote to memory of 2796	2760	svchost.exe	33
PID 2760 wrote to memory of 2796	2760	svchost.exe	33
PID 2760 wrote to memory of 2796	2760	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c.bat C:\Users\Admin\AppData\Local\Temp\32ee91cbd3324abc7a46df4ceda91688_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2660
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 52
    3⤵
    - Program crash
    PID:2796

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/668-7-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2760-8-0x0000000000C22000-0x0000000000C23000-memory.dmp

Filesize
4KB

Download