e14e31e674a1b647dc02cf6cf45cded64bff03313212aac0a4f71df9943f4ca6

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 19:15

Target

2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe
Size

7.3MB
MD5

2a7d52b00a74e744480079e4977db73d
SHA1

86e6fa484417506414e7ed9c401e7df7f6a97b96
SHA256

e14e31e674a1b647dc02cf6cf45cded64bff03313212aac0a4f71df9943f4ca6
SHA512

4c3f1ad856683d153ee7f9f012e8f36c8a24583aca636323a988867bad44f26e72ab9c32f2a034ac31ba76bd0602da04081fbd92429b940d666057b79aa793ef
SSDEEP

98304:BxC3ud6MOIvysiwCQKzo5qphIHVruP3WpF3UdE1hZHEdLF9mil+:2GQFMkhgJuP32+dmhZk/n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2844	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2916	2844	2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe	28
PID 2844 wrote to memory of 2916	2844	2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe	28
PID 2844 wrote to memory of 2916	2844	2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe	28
PID 2844 wrote to memory of 2916	2844	2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a7d52b00a74e744480079e4977db73d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 156
  2⤵
  - Program crash
  PID:2916

memory/2844-0-0x0000000000F30000-0x0000000001711000-memory.dmp

Filesize
7.9MB

Download
memory/2844-1-0x0000000000F30000-0x0000000001711000-memory.dmp

Filesize
7.9MB

Download
memory/2844-2-0x0000000000F30000-0x0000000001711000-memory.dmp

Filesize
7.9MB

Download