1fb6c472f64fe33bed2c46668010f6f85d99d474d4fd0ab4f3e1139295448a81

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:33

Target

67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe
Size

330KB
MD5

67080efedef8b8aec9abe0f36d358cf7
SHA1

7355dbd051ff5872a5d3f75bef242ae75b1a45c3
SHA256

1fb6c472f64fe33bed2c46668010f6f85d99d474d4fd0ab4f3e1139295448a81
SHA512

1c8d8f52fabab0ef2b4f5078d905e9fff5c216e4948a76b11bca8e41f4cc48af9493c8f10630bf2f87b08fdd2e569c8371143f3f2a01e0838f30d0d1f7bb4400
SSDEEP

1536:cCO1Pt8jhwii9FCl+wWPf0/hehvcob43tMEEPAq:cCO1Pt8dwii9FC3WPf7cZtM/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2272	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2268	2272	67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2268	2272	67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2268	2272	67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2268	2272	67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67080efedef8b8aec9abe0f36d358cf7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 36
  2⤵
  - Program crash
  PID:2268

memory/2272-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2272-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download