be07b93f137547ec5936ebe3417c633297539086b6cea1f1baebf37d3d53aba7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 02:30

Target

32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe
Size

905KB
MD5

32438e9f7afdceed6e501c07d3adcf48
SHA1

ea92b903057d0727fbb7d1ba265331820f4e4a48
SHA256

be07b93f137547ec5936ebe3417c633297539086b6cea1f1baebf37d3d53aba7
SHA512

03f2d7684f9929679c5e3e125cc744ff89e1c37638676597c0f13402cb53fab6c42cb39f1b8ed806e68a6975db6794c635220d473608308b8798f91bd30172bc
SSDEEP

12288:CmQd+DJHU5F9fpdg3J4TaxIf5kt+oTL1ZMJc3cCser:q8HU5TfpIuTaq7oTL1ZHcIr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	2264	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1524	2264	32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1524	2264	32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1524	2264	32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe	28
PID 2264 wrote to memory of 1524	2264	32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32438e9f7afdceed6e501c07d3adcf48_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 212
  2⤵
  - Program crash
  PID:1524

memory/2264-0-0x00000000010F0000-0x00000000011D7000-memory.dmp

Filesize
924KB

Download