1d7d68cf9a53267999d3043bdfe9214c02373d59b4f0a44db93f083dbafe21cc

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:52

Target

615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe
Size

282KB
MD5

615b2bf5c4c9f8247cbb6fabee6fb743
SHA1

45176458c3c31c7131821a6530ca7b6e0dc423c0
SHA256

1d7d68cf9a53267999d3043bdfe9214c02373d59b4f0a44db93f083dbafe21cc
SHA512

5ae0db103139bfa69e77e24cbc7a88a5301dce396db77827768452d82176b8db4a56445acea36851e49eaca5dc52d7e0f68624c48f8d5d810604d0db5932cf35
SSDEEP

6144:65Dimk83GUrGbR0fRPkTiaFdTcDRTdKO1LWmH63E:65mm13GUrsR0PkTiaFYRTdKOZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2748	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2788	2748	615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2788	2748	615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2788	2748	615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2788	2748	615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\615b2bf5c4c9f8247cbb6fabee6fb743_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 200
  2⤵
  - Program crash
  PID:2788

memory/2748-0-0x0000000001000000-0x000000000108D000-memory.dmp

Filesize
564KB

Download