5e5cf2b9b2f8b8d8d8db1104762468327fb769a0776ca7af335c158a2d7f2056

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:16

Target

438d464120595ab523658c510f9555a7_JaffaCakes118.exe
Size

401KB
MD5

438d464120595ab523658c510f9555a7
SHA1

20c6c48c3f09c21b4b83324a25a033c25d4308a8
SHA256

5e5cf2b9b2f8b8d8d8db1104762468327fb769a0776ca7af335c158a2d7f2056
SHA512

b71e48a8aa0770821ee10fe9748cf6412bf6c7e0a6db396957460b130aff424933305f5da518461005c428af01884d2926a845db6637b3c82809d32f603f29ae
SSDEEP

12288:oRBW4PaHSC+vevFPTktqhYbxMhUJHpEELZfeVOpWL7C:94PaX+vedr+JhXEyZmkWXC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1932	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2024	1932	438d464120595ab523658c510f9555a7_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2024	1932	438d464120595ab523658c510f9555a7_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2024	1932	438d464120595ab523658c510f9555a7_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2024	1932	438d464120595ab523658c510f9555a7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\438d464120595ab523658c510f9555a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\438d464120595ab523658c510f9555a7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 92
  2⤵
  - Program crash
  PID:2024

memory/1932-0-0x0000000000463000-0x0000000000464000-memory.dmp

Filesize
4KB

Download