3b6a35bcac4bfd463c2e7b28e10b95a0fce5c1a123334e48995e017bcd054445

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 08:35

Target

2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe
Size

430KB
MD5

2922deb2aeba7939efd4ed1d8e914b76
SHA1

43f1938af09c81ee4db17b0f28aea869ea229130
SHA256

3b6a35bcac4bfd463c2e7b28e10b95a0fce5c1a123334e48995e017bcd054445
SHA512

571823e4c6bb0e3f20de42dfe9c8c3c9e67be0ff0c2cacf10c2ac0d7fca383ca8d28c5777917bf97ea6b1ea0794c0f2ec8eacf10d2da31300f4a97a0a793c44e
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4r:UdwNIm1B1zzqrh9Jf+btwSfgUnBI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2324	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2832	2324	2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2832	2324	2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2832	2324	2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2832	2324	2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2922deb2aeba7939efd4ed1d8e914b76_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 116
  2⤵
  - Program crash
  PID:2832

memory/2324-0-0x0000000000E00000-0x0000000000E70000-memory.dmp

Filesize
448KB

Download