1bc7b8ec5b560893981f8264e819c75f4731a0734ec3e49cc54a906a3143584d

Analysis

max time kernel
106s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 04:17

Target

e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe
Size

15KB
MD5

e8510e60bb69906663266ed956c44a0f
SHA1

a1e60443308e8b7768d13b12828dffbe1f7c9775
SHA256

1bc7b8ec5b560893981f8264e819c75f4731a0734ec3e49cc54a906a3143584d
SHA512

714765aad30a83cf1e9f26b541f20b8aeea237f837a5ef6db229add1c844bafd12b4187d726950326cf297cfe3e81cc139560c70367294349a191973b4dde008
SSDEEP

192:ZYf2ZQu9g0tYuokm+SRJkDlBpaViNnrP4iC9Yg8IDl4bXjHOk8Y9:ZYfKQu9g0S/km+SRJA/NvssXjHeY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2956	1848	e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe	31
PID 1848 wrote to memory of 2956	1848	e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe	31
PID 1848 wrote to memory of 2956	1848	e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8510e60bb69906663266ed956c44a0f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 524
  2⤵
  PID:2956

memory/1848-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download