fde297bebba2bad55b2eab5998b42a0e911fdb963cef32ae47bb7f17009da76c

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:00

Target

1b37bb48318549674ac213c89064da57_JaffaCakes118.exe
Size

168KB
MD5

1b37bb48318549674ac213c89064da57
SHA1

c41e7b6d0ad50e22a245ea638e85a166ba56e48c
SHA256

fde297bebba2bad55b2eab5998b42a0e911fdb963cef32ae47bb7f17009da76c
SHA512

a47cd72c942c84a627244ec7e0066d3f179159532d2d43f0d14564498dacc765fe3bc35527d2d4d32f5a7ed93b277c7d3bfda75213455afd65e649cac491202f
SSDEEP

3072:T8NQKPWDyDReaJltZrpRnvz6ljkYxXPrQcYaUEYvq2j:wNSDyDRvthpZ6lgwPrHYayS2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2136 2140 WerFault.exe 1b37bb48318549674ac213c89064da57_JaffaCakes118.exe

pid	pid_target	process	target process
2136	2140	WerFault.exe	1b37bb48318549674ac213c89064da57_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b37bb48318549674ac213c89064da57_JaffaCakes118.exe

description	pid	process	target process
PID 2140 wrote to memory of 2136	2140	1b37bb48318549674ac213c89064da57_JaffaCakes118.exe	WerFault.exe
PID 2140 wrote to memory of 2136	2140	1b37bb48318549674ac213c89064da57_JaffaCakes118.exe	WerFault.exe
PID 2140 wrote to memory of 2136	2140	1b37bb48318549674ac213c89064da57_JaffaCakes118.exe	WerFault.exe
PID 2140 wrote to memory of 2136	2140	1b37bb48318549674ac213c89064da57_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b37bb48318549674ac213c89064da57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b37bb48318549674ac213c89064da57_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 160
2⤵
- Program crash
PID:2136

memory/2140-0-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download