b4da25de8ccdfda87112fd5b2fc19cd4e07e778ccafd4bc8adc5e8673327bb9d

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:00

Target

f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe
Size

28KB
MD5

f4b5e2d244a2fc3e341234837b2e4717
SHA1

a401bff7013d59f6c5dec4410f1284b7a1d96407
SHA256

b4da25de8ccdfda87112fd5b2fc19cd4e07e778ccafd4bc8adc5e8673327bb9d
SHA512

d99af6cb0cd27b700f5580c46697565eb1a50c5db9683dc27e97628fc2144eb25939b910c8b4581a5eb895b87ec80036bad18b821b6fae1fe2f5e68fde7f6b1d
SSDEEP

384:XhekdQyrhXwAxZ54AGEjzDIqcL1pkvMIO1drmB8P/Sj6/jEOop1:xekdQCd5rHkqcLIO1dI2/Sj3z1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	1404	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2928	1404	f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe	28
PID 1404 wrote to memory of 2928	1404	f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe	28
PID 1404 wrote to memory of 2928	1404	f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe	28
PID 1404 wrote to memory of 2928	1404	f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4b5e2d244a2fc3e341234837b2e4717_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 44
  2⤵
  - Program crash
  PID:2928

memory/1404-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1404-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download