1e57002be20d84b42f0212e388ad60e6783c8640a66823f3b982d121a45b0ad6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:25

Target

39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe
Size

316KB
MD5

39803e3f00c62db21a20facb4f57ecf5
SHA1

9724ca2522262fe964141dbbee8b3a543bb8f00a
SHA256

1e57002be20d84b42f0212e388ad60e6783c8640a66823f3b982d121a45b0ad6
SHA512

792e7206ea2f396bb7e2e34a01edfbd4857cada93a5ff6236f5253a5ec4792fbf510b822567c0b137ecea0f0181fe8a6c0e795545e8b60c66c2e4010cddb0673
SSDEEP

6144:jMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOayfS5DuGDf5Aj7:jMTi0uhMqe9ts2zWTpMmCG7Aa5DdAn

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2084	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe
600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2084	WerFault.exe	31

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2084	600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe	31
PID 600 wrote to memory of 2084	600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe	31
PID 600 wrote to memory of 2084	600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe	31
PID 600 wrote to memory of 2084	600	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2576	2084	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe	32
PID 2084 wrote to memory of 2576	2084	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe	32
PID 2084 wrote to memory of 2576	2084	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe	32
PID 2084 wrote to memory of 2576	2084	39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe	32

C:\Users\Admin\AppData\Local\Temp\39803e3f00c62db21a20facb4f57ecf5_JaffaCakes118mgr.exe

Filesize
59KB

MD5
0e0f0ae845d89c22bb6385f64a6b85fd

SHA1
0f3f1e7f18ab81572c5ce938d3880d4a5d7100ac

SHA256
5a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd

SHA512
baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350

Download Submit
memory/600-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/600-13-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download