85011df6e499dc11e2e5d22b55df395f7562872598bc6c64dc0966ac663b0450

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 16:21

Target

426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe
Size

59KB
MD5

426faa6ee2b4d586d7987886f59d6ad5
SHA1

1277153308a9894a7de4cc223a33e0e38915474f
SHA256

85011df6e499dc11e2e5d22b55df395f7562872598bc6c64dc0966ac663b0450
SHA512

21600b39e3313873c6d14d642ad42d97f01cde1f0179a6d905d6bfd3bf6b64981f75150ca909d1ffe3b22147d22524ea7d91407a0ad29903c2c858d215c2c2bb
SSDEEP

768:IhC6CZtFARpv9T/3h7kKJtCgWYln6WZZ262VnoSlrTZSyDVx:enCZtejN/VhAylnxZ46woWvD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2572	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2592	2572	426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2592	2572	426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2592	2572	426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2592	2572	426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\426faa6ee2b4d586d7987886f59d6ad5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 36
  2⤵
  - Program crash
  PID:2592

memory/2572-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download