f78c697785bb26011ffc36602a82f08c8c49b4fa6f38d11aae42eeb63094dfe6

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 00:18

Target

1816d794cb87510a8df949837abc777a_JaffaCakes118.exe
Size

426KB
MD5

1816d794cb87510a8df949837abc777a
SHA1

a3a443a7582aa15549a02b71462c24300feb6191
SHA256

f78c697785bb26011ffc36602a82f08c8c49b4fa6f38d11aae42eeb63094dfe6
SHA512

d99423f03edddb1e06cc60c8149336748dafb688704a2608e816fa9d20258a1729b247ff79b320fdba36ccae7dd365124b64dc15c35a1284c8ca3c2516cdab3a
SSDEEP

6144:BMfTbKMEHh94+L8HV7qDUIufwngv36Zy7iakxtGLlt0AxZTdCozthT1G:Cf/Shi4mV+UIevbk7GpK2Ekn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 1684 WerFault.exe 1816d794cb87510a8df949837abc777a_JaffaCakes118.exe

pid	pid_target	process	target process
1632	1684	WerFault.exe	1816d794cb87510a8df949837abc777a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1816d794cb87510a8df949837abc777a_JaffaCakes118.exe

description	pid	process	target process
PID 1684 wrote to memory of 1632	1684	1816d794cb87510a8df949837abc777a_JaffaCakes118.exe	WerFault.exe
PID 1684 wrote to memory of 1632	1684	1816d794cb87510a8df949837abc777a_JaffaCakes118.exe	WerFault.exe
PID 1684 wrote to memory of 1632	1684	1816d794cb87510a8df949837abc777a_JaffaCakes118.exe	WerFault.exe
PID 1684 wrote to memory of 1632	1684	1816d794cb87510a8df949837abc777a_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1816d794cb87510a8df949837abc777a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1816d794cb87510a8df949837abc777a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 88
2⤵
- Program crash
PID:1632

memory/1684-1-0x00000000004C3000-0x00000000004DA000-memory.dmp

Filesize
92KB

Download
memory/1684-2-0x0000000000400000-0x00000000004D9B1B-memory.dmp

Filesize
870KB

Download
memory/1684-0-0x00000000004C3000-0x00000000004DA000-memory.dmp

Filesize
92KB

Download