cdf1a29208efd6c6f4dace4234d9fafe87e0c0903da4a207daffbd2d351ad95f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 23:35

Target

5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe
Size

68KB
MD5

5e27ae66fb47fbbcbac3136ed94c77af
SHA1

ec6bc347b88715e85824541e1168160483f2edd8
SHA256

cdf1a29208efd6c6f4dace4234d9fafe87e0c0903da4a207daffbd2d351ad95f
SHA512

8d8e356fcaafee199a20a85528af18b140ae3809b016fc04da62f5c5efd75ee0413fea6fa310ccd5e16d5d515624c5b532200a535645bfa61d7d21cbfa1c4f90
SSDEEP

1536:rB1uogW/LAqPhF7H7ZwAscRc2Ektd2W5lehlH:VEogW/BzLaADq2Bt4WHg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2476	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3036	2476	5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe	31
PID 2476 wrote to memory of 3036	2476	5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe	31
PID 2476 wrote to memory of 3036	2476	5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe	31
PID 2476 wrote to memory of 3036	2476	5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e27ae66fb47fbbcbac3136ed94c77af_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 88
  2⤵
  - Program crash
  PID:3036

memory/2476-1-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/2476-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download