22e8a55ce19ad3dd67cfdcf9e0394839772bf9890872af198aa20e088e4213bb

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:43

Target

5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe
Size

30KB
MD5

5aaec8c2fd51ea3b78e76d03dee1e7e6
SHA1

e1a0e4f2043c12aa2b8dfa751d551fdc7fc60cc9
SHA256

22e8a55ce19ad3dd67cfdcf9e0394839772bf9890872af198aa20e088e4213bb
SHA512

76ef118ac695429ff81b359f95c40bedf29f736ec0a37338b2bc5097bc78b4fad4ab9223f31de1e0d3ff18a00e05d4081fb72b01914d979196099ee6062b08b5
SSDEEP

384:KxV5Kwk+AIbICR29FFGyPbpMKd92MczyJHHkodGyl6hDLSSOHS3sfWyagBr9+oOp:aV5OYM7RbWz2lGyifSSx2B+oOp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	824	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2240	824	5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe	30
PID 824 wrote to memory of 2240	824	5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe	30
PID 824 wrote to memory of 2240	824	5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe	30
PID 824 wrote to memory of 2240	824	5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5aaec8c2fd51ea3b78e76d03dee1e7e6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 36
  2⤵
  - Program crash
  PID:2240

memory/824-0-0x0000000000406000-0x000000000040C000-memory.dmp

Filesize
24KB

Download
memory/824-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download