62398002de6a810cda299ed6a0f5b79e0474b92722565d749f46ea754e2c1101

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:46

Target

5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe
Size

11KB
MD5

5ade4b0857471004c5b72dbd51a7cfaf
SHA1

282a47a513bfdb096dd0ef229770c33d0169ebbb
SHA256

62398002de6a810cda299ed6a0f5b79e0474b92722565d749f46ea754e2c1101
SHA512

c6e5ced55530b439d62836d5a2d9f3c5d06080ba21ebd05a93d5d2a5b920a47892082751dd23b157849292c60bd0cc0a63ac9bef41188a11b6f195bdec2148c2
SSDEEP

192:MWyvg6SWpgksOxBb1D1Nz/OjvWSCsE3pOaHcLh8QzcJU6ILIkJmSpVwRiIiap:MWyvghWJVbZb7OjvW3XZd4WS9LIApVwh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1480	2920	WerFault.exe	30

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1480	2920	5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ade4b0857471004c5b72dbd51a7cfaf_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 252
  2⤵
  - Program crash
  PID:1480

memory/2920-0-0x0000000013141000-0x0000000013142000-memory.dmp

Filesize
4KB

Download