b9c71b7240ef61330ffa1a5fedcf77bb08c04334254decaece6eea1951324d31

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 04:47

Target

5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe
Size

373KB
MD5

5a856d3581d2a4c0ef466c780f88c95b
SHA1

4e69062b0621cd40bc55857061b75e71c2151daf
SHA256

b9c71b7240ef61330ffa1a5fedcf77bb08c04334254decaece6eea1951324d31
SHA512

ef299bb37eaa78e732fe48d70ebe900e1ca33fb8e3882a14ceee8c1322db0a81dc54fbbe32b39d2630f5622ba76471082cc11d7eb11eced0eaa58e0e1c429c85
SSDEEP

6144:1wxIij8jmeTOhp1tsozPPTa5gTSsqyr039tHAYeS/bp5mAwI0cuslGoS08P:6x5AfT8P/zXTkyIDHAqchI0cuslGoS0y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1972	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1052	1972	5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe	29
PID 1972 wrote to memory of 1052	1972	5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a856d3581d2a4c0ef466c780f88c95b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 188
  2⤵
  - Program crash
  PID:1052

memory/1972-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1972-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1972-2-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download