97c42a867a707b17a33ff2cfb2b2407df60c592139763855594f1ed33cee25f4

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 19:13

Target

1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe
Size

167KB
MD5

1c2dc280425180936a40bc28c1453754
SHA1

845074e871bcea11973c5670ec008460d49aaa76
SHA256

97c42a867a707b17a33ff2cfb2b2407df60c592139763855594f1ed33cee25f4
SHA512

41dff89d8d24cef5113aebb1d1561de8ec0ba60eddd21674a5e85ec5557360b3ab547ad7eeff6b7c44dae2f1b24554df495fcb9c896f3177247f223fe7b9cc1e
SSDEEP

3072:/NQKPWDyBI0fFJltZrpReFX3sOb+yD91jcpdhyzfNQbFPUcwNusHdM66:/NSDyBIkFthpU+Ks7YmFPUgP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 2072 WerFault.exe 1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe

pid	pid_target	process	target process
2028	2072	WerFault.exe	1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe

description	pid	process	target process
PID 2072 wrote to memory of 2028	2072	1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe	WerFault.exe
PID 2072 wrote to memory of 2028	2072	1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe	WerFault.exe
PID 2072 wrote to memory of 2028	2072	1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe	WerFault.exe
PID 2072 wrote to memory of 2028	2072	1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c2dc280425180936a40bc28c1453754_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 160
2⤵
- Program crash
PID:2028

memory/2072-0-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download