e25904cacb050181d38e72c8139313600f0a4cf8b6fa2fb5a96af4b07af98b09

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 18:05

Target

a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe
Size

212KB
MD5

a1a70a7a034f5d8a171b23ee9ef89019
SHA1

b09aac38dd6c67c3e68c675c136b239e1b256cf3
SHA256

e25904cacb050181d38e72c8139313600f0a4cf8b6fa2fb5a96af4b07af98b09
SHA512

f9becb67467b1951bf38fbbe8f8b9770f48776eda1ef489fcf4f034303abd6f287633d77b62a412b2d5d58b3fa8b65ffe970a0f81c7206d1ed11e9be51acf0d9
SSDEEP

3072:0y2EevyNMyhKN0g/D9lyovGLfof58ji4+7y9aqWLNOO:dWm/+DDvvf58u4FSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2792	2036	a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2792	2036	a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2792	2036	a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2792	2036	a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1a70a7a034f5d8a171b23ee9ef89019_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 156
  2⤵
  - Program crash
  PID:2792

memory/2036-0-0x00000000002B0000-0x00000000002E8000-memory.dmp

Filesize
224KB

Download