394a49030a9b4cb26c8fc44f699dac2bd0723b41f896c46b885aabcde3e038b5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 07:29

Target

fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe
Size

4.3MB
MD5

fc3e251d4b685aaf70ad23949a351a5c
SHA1

05cabd0f99daf0a695e31f040373d9fcc938f33f
SHA256

394a49030a9b4cb26c8fc44f699dac2bd0723b41f896c46b885aabcde3e038b5
SHA512

3322b49489466cbfc0b0afd7d9e33d7054a9924a990a25ac3b55701bbe8719465e5393df306b6a04b79acdb8c55d3e3b69e12830425a2d4c53b5861a2ddb9618
SSDEEP

49152:l0g7mM+M6RkMkIM7I067k6sNBk9/fw2BwfmM0fbtIR8GLfU3:EM+M6RkMkIM7r6sNi9XwgwfoRIir

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2864	2368	fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2864	2368	fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2864	2368	fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc3e251d4b685aaf70ad23949a351a5c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 192
  2⤵
  PID:2864