6b343d099852bad6ac365ea6de11f2f22c293a2bbfac9a2587572903b0330adc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 03:59

Target

f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe
Size

199KB
MD5

f7368d0dfc50858479e4639a3ac921d3
SHA1

8f895299d739d87a8c854d1300aff24540b3d18b
SHA256

6b343d099852bad6ac365ea6de11f2f22c293a2bbfac9a2587572903b0330adc
SHA512

61ef9a1f6c6662cbfbc2d238f2efe5290900c7b341dcd3fada209570765bf7e364ec8cf92e626fc881d216599fd7568e889e990232b55aafdc8b02803d325f0f
SSDEEP

3072:epwc/N6vAzTPzaIuVbZOJmXGC0rwm0ksA6bJbAXemJjVOlnLUGMCFhpYy4b/K:c6TIfJtC0sbKJBOlLuoYy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2904	2860	f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2904	2860	f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2904	2860	f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2904	2860	f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7368d0dfc50858479e4639a3ac921d3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 36
  2⤵
  - Program crash
  PID:2904

memory/2860-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download