11dc9e8072fc7efde3e37d2ad6bdb92feff7ea73a1f3d64b68f503a4ab22c93e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 01:50

Target

379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe
Size

113KB
MD5

379ffd887d6724afe8c4a4acd95f2a72
SHA1

f22c8b637f684293d2a65e453517caf7282e1dfa
SHA256

11dc9e8072fc7efde3e37d2ad6bdb92feff7ea73a1f3d64b68f503a4ab22c93e
SHA512

794536905d9b7197421c3b88cf9e51ad55ff9e4dc9f5bb0431ef26c1067b4d0c93fe791e8a1f69f148dc598429448ab056cf7cbb215088948b1fc6590639567c
SSDEEP

1536:Z+X5oku2zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:TVSHIG6mQwGmfOQd8YhY0/EqUG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2340 836 WerFault.exe 379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe

pid	pid_target	process	target process
2340	836	WerFault.exe	379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe

description	pid	process	target process
PID 836 wrote to memory of 2340	836	379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe	WerFault.exe
PID 836 wrote to memory of 2340	836	379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe	WerFault.exe
PID 836 wrote to memory of 2340	836	379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe	WerFault.exe
PID 836 wrote to memory of 2340	836	379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\379ffd887d6724afe8c4a4acd95f2a72_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 52
2⤵
- Program crash
PID:2340

memory/836-2-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/836-0-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download