2739aa7a02b8868fec2ca03010a7f31060248a9d298c65bdf40a95ea6e364073

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:45

Target

2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe
Size

428KB
MD5

2d6a3f82ad25a4cc30c4cca72376102d
SHA1

75c4966acc0e89217d84a0e555b90db7d69e77fb
SHA256

2739aa7a02b8868fec2ca03010a7f31060248a9d298c65bdf40a95ea6e364073
SHA512

dea5bc8ef089ead828b7ce0429f27d4a3eb0b7a5b485c5f56228408ef8047dcb7361abaf4edab1ed2f14297e0336055ebce298d38717845a207beb9f1f8a5d1d
SSDEEP

6144:Ulsy4TNbEm1B1zzqaCh9Ju/2x+vw0b8ajNglS2+gUXpP9YC4rFO:UdwNIm1B1zzqrh9Jf+btwSfgUnBI0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	328	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2336	328	2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe	28
PID 328 wrote to memory of 2336	328	2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe	28
PID 328 wrote to memory of 2336	328	2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe	28
PID 328 wrote to memory of 2336	328	2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d6a3f82ad25a4cc30c4cca72376102d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 116
  2⤵
  - Program crash
  PID:2336

memory/328-0-0x0000000000F30000-0x0000000000FA0000-memory.dmp

Filesize
448KB

Download