2bd0d5010a698cb6c58e11a2635fa9885aea3d3915f66b7026b4b6fdd83820a2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:22

Target

1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe
Size

112KB
MD5

1b1aa5980c22310420eb7c428c93e759
SHA1

d29978b2bedaf00908649387c9f546636573b3ad
SHA256

2bd0d5010a698cb6c58e11a2635fa9885aea3d3915f66b7026b4b6fdd83820a2
SHA512

086a675028c456d7a89c117c8e053df15a0ee50b160fd19b4420a32ae375b5dc3fbedbb22b0edcda92ff1098662658248e7877a0c4291da628abb07f0ef2735e
SSDEEP

3072:0GJ6VVLD41UXhXpYuc8IJodk+GOi18N96Tde2pArf:QDXUu7xHi18N8Nez

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 1936 WerFault.exe 1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe

pid	pid_target	process	target process
1896	1936	WerFault.exe	1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe

description	pid	process	target process
PID 1936 wrote to memory of 1896	1936	1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 1896	1936	1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 1896	1936	1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 1896	1936	1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 88
2⤵
- Program crash
PID:1896

memory/1936-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download