a3cb28186df9ff5005caca9de243283245c1fae2962d564d02cd7bfcaba9dd03

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 15:59

Target

ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe
Size

94KB
MD5

ea5da2ef56e03e4f999cf71ca7dd10c3
SHA1

768f2f9d718fe3d45073fef1194f8017f85f9570
SHA256

a3cb28186df9ff5005caca9de243283245c1fae2962d564d02cd7bfcaba9dd03
SHA512

3ffe43b569b50405e7322741cef49ff9c49ba39e76fa68d44d3870de25b9301df4e365220df81ff482d63ed0b6d89b47eb8cadebd06449f20e65cbcbdef6afaa
SSDEEP

1536:qUWfaEiAaxykxSOyf7dfEfblaBterxVEqtF/HYc1DNXhk64cwVqn7Vb0c7x+CHQl:iiE9a3Qd8fZSerHD/nXhj4ckq7ZtjQks

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2956	2660	ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe	28
PID 2660 wrote to memory of 2956	2660	ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe	28
PID 2660 wrote to memory of 2956	2660	ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe	28
PID 2660 wrote to memory of 2956	2660	ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea5da2ef56e03e4f999cf71ca7dd10c3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 36
  2⤵
  - Program crash
  PID:2956

memory/2660-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download