20eef5a9a56da0ba4402b570078cff27cb1aea75d82babf4ca9ca3ef31107b9d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 06:00

Target

4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe
Size

67KB
MD5

4884cd72e144a97cdfcb4059a3578150
SHA1

8815808d6fd8212c9968f59fcd4ae8c905642e6b
SHA256

20eef5a9a56da0ba4402b570078cff27cb1aea75d82babf4ca9ca3ef31107b9d
SHA512

70a1fbf6d065b2f99fde340dfce7e5e919a03e12b1aafaf2a9c0003de457b20cbcdc752708458138e28b54c271c5bef1f4c268457aacaa94118b5e11b1a642b5
SSDEEP

1536:C+f+ozh2A/KwaulUOCvuZYZRVYr0YYQc5qh0nfA+V:5hLzau3KaQEI2uX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2688	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2704	2688	4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2704	2688	4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2704	2688	4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2704	2688	4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4884cd72e144a97cdfcb4059a3578150_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 36
  2⤵
  - Program crash
  PID:2704

memory/2688-0-0x0000000000DA0000-0x0000000000DCA000-memory.dmp

Filesize
168KB

Download