c5eca733424dfc3754bd5516c64c8c1284ee1d01b73c097b08a24e4d0f70758e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:22

Target

5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe
Size

120KB
MD5

5becfad02adbf20d8a00b475a5191720
SHA1

ff565d912587919aa320b7f9cba93d44d085a7c8
SHA256

c5eca733424dfc3754bd5516c64c8c1284ee1d01b73c097b08a24e4d0f70758e
SHA512

2036622625247724e31b07ac5d1e1752b2fa25332d3b68813ff76e17dbbedafb4d64165bfb95cd39b066fe8c6931c8d73c87704018cd84eec5e56f537f095655
SSDEEP

3072:fqnmgmR6OjVJpX0tSj1Q6jt2eAEx+ebhgHLi:ynTuhxvktw1Q+OHHLi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2604	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2456	2604	5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5becfad02adbf20d8a00b475a5191720_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 36
  2⤵
  - Program crash
  PID:2456

memory/2604-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download