d8aebf37eb7c349aaa47e4f2e543d516eb1404209a2d7a39550dc32bc1a2f497

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 08:21

Target

5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe
Size

23KB
MD5

5fbb7d6d13dca0ebead72231c5a65d62
SHA1

1ec5aea56b3d20c60fa07c90637e0f88c9cda30e
SHA256

d8aebf37eb7c349aaa47e4f2e543d516eb1404209a2d7a39550dc32bc1a2f497
SHA512

80ba9111efe421f727b95d512fffa441e49aeee1dc98b177a7cacc8694e0c5a6e566ce0fa2db0c061f75e1a85d9ed75c5821c8732507dc00b923839f5ccb7656
SSDEEP

384:VGTj4TLPCw2/qvB/PcpL/RlufKowvlmXBdk25RA25+/jOwA47hJN+4x:kT0PvcQklFo++BS+A+QOWJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2708	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2748	2708	5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2748	2708	5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2748	2708	5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2748	2708	5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fbb7d6d13dca0ebead72231c5a65d62_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 136
  2⤵
  - Program crash
  PID:2748

memory/2708-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download