0cee5473bf7684934c8e60664e78becdcccd3e3be2891c1d209bc5ef003aabb1

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 11:29

Target

417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe
Size

100KB
MD5

417bd3f2957e650c97f49fb49dd8784c
SHA1

9872dd88e50be853568f31dafb0966b8d926ac96
SHA256

0cee5473bf7684934c8e60664e78becdcccd3e3be2891c1d209bc5ef003aabb1
SHA512

aa52d8bb61961fb1b28a4a3b0234ab6d2c9360825368da40af6717b810d5430c5eb50ca3a8f4ffdce6492c76dc90a4e547c0c112685f4f4e937555db78a18d60
SSDEEP

1536:c6J2SBYICW5iJbmjdvHYitL5URbQvbFTS43dLEZeOa5Ls8E49YvOdqPXp3TOGij+:f2SjiJyhgBkvbxSDgp5LsPZOe5jOGIir

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2928	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2300	2928	417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2300	2928	417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2300	2928	417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe	29
PID 2928 wrote to memory of 2300	2928	417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\417bd3f2957e650c97f49fb49dd8784c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 92
  2⤵
  - Program crash
  PID:2300

memory/2928-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download