3ea154612a592ed152a8ca4f90c78b111bac95cdede261c2f6978352c077aa16

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:39

Target

216df9384af4007e98de022ecf96e080_JaffaCakes118.exe
Size

430KB
MD5

216df9384af4007e98de022ecf96e080
SHA1

318b8cd399df24e6f99d50df10384717f1332062
SHA256

3ea154612a592ed152a8ca4f90c78b111bac95cdede261c2f6978352c077aa16
SHA512

f1dbb0f9b4aa031b6a8a6aded4484d03ee6ca1dd142794c5f5570c60fd55862da0f971f6cc8685968bbb15f2ff95dd580b0a2e8507353a37328e4a51bcd7b231
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	2264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1880	2264	216df9384af4007e98de022ecf96e080_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1880	2264	216df9384af4007e98de022ecf96e080_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1880	2264	216df9384af4007e98de022ecf96e080_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1880	2264	216df9384af4007e98de022ecf96e080_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\216df9384af4007e98de022ecf96e080_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\216df9384af4007e98de022ecf96e080_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 116
  2⤵
  - Program crash
  PID:1880

memory/2264-0-0x0000000000C60000-0x0000000000CD0000-memory.dmp

Filesize
448KB

Download