4892d203ea5cf64230ae3598673e9d5210de0390eb0dce199ab060f3b0009275

Analysis

max time kernel
141s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 06:04

Target

5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe
Size

991KB
MD5

5abe415785458a22d5bf80a9087f6dc4
SHA1

fff52928dbcc002ae8df4c5bd9f46231e62e55d2
SHA256

4892d203ea5cf64230ae3598673e9d5210de0390eb0dce199ab060f3b0009275
SHA512

a925c734ffdf81c21063afe94970c63561e881045dcf9cf3828910e891244d4a2aa0be7210b00cd6092781314d554f3fe057434460c8ad0cb3ac86bb113c7f91
SSDEEP

12288:cNdbozXjhMTbsHycars/59S9nSQxVB16ZqrtxmSaTZRSHsDrB4f62KgZUV7KnUYB:0oDjhtBGBD1Brt4nDVSX8KUC+Y59

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2556	WerFault.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2328	2556	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2328	2556	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2328	2556	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2328	2556	5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5abe415785458a22d5bf80a9087f6dc4_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 300
  2⤵
  - Program crash
  PID:2328

memory/2556-0-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/2556-1-0x0000000000280000-0x00000000002AC000-memory.dmp

Filesize
176KB

Download
memory/2556-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2556-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2556-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2556-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2556-10-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2556-9-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/2556-8-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2556-7-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2556-6-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2556-11-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/2556-12-0x0000000000280000-0x00000000002AC000-memory.dmp

Filesize
176KB

Download
memory/2556-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download