7543040a24e61f2e733367cade4d5fbfbac658a141686c60aaf584f34fc778b8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 07:10

Target

0717541267203492f3682714972112b0_JaffaCakes118.exe
Size

301KB
MD5

0717541267203492f3682714972112b0
SHA1

5741e8df0baa313eecf5954e70db2500984e3232
SHA256

7543040a24e61f2e733367cade4d5fbfbac658a141686c60aaf584f34fc778b8
SHA512

83edb253707d11ecccc087660748ef53669fbd8920385d29295038b80c891be1e772b56a73f99b8e2dabfd64fae62d441772e6652a60276545628cd9abfdd610
SSDEEP

3072:WnrIHfMZt3g4QeaglB1bv4mErqaxFavrvqpD4pH+3BipJmd4ptQ2M:gZtYpg+RipJmd4q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1640	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2172	1640	0717541267203492f3682714972112b0_JaffaCakes118.exe	29
PID 1640 wrote to memory of 2172	1640	0717541267203492f3682714972112b0_JaffaCakes118.exe	29
PID 1640 wrote to memory of 2172	1640	0717541267203492f3682714972112b0_JaffaCakes118.exe	29
PID 1640 wrote to memory of 2172	1640	0717541267203492f3682714972112b0_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0717541267203492f3682714972112b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0717541267203492f3682714972112b0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 560
  2⤵
  - Program crash
  PID:2172

memory/1640-0-0x0000000000B10000-0x0000000000B5E000-memory.dmp

Filesize
312KB

Download
memory/1640-1-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-2-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download