e3b8c34b27ee9f2f4171a3901dd4aaa19d1e8469f0426e8d3f2e7d2b6fd3df47

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 19:58

Target

003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe
Size

180KB
MD5

003c4954c388677232735d1454e1c0e7
SHA1

53c68aaf79fe38784722897421b6501ca646cd6a
SHA256

e3b8c34b27ee9f2f4171a3901dd4aaa19d1e8469f0426e8d3f2e7d2b6fd3df47
SHA512

87b3b4b2760b896e67949610609c22b7c56e18643af21ca69e7a95f204d4c7089e60f9e504f22095966f897431f1229755bee4d37befed53c6a616a737dc008d
SSDEEP

3072:ZQrOqkwWCgMGE8OOEOW0E4mzZMonEWa9byWr8dYv+TeoDGE0K:ZQNkhCgfJEO76OoG9+Wr8dYm7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2344	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2276	2344	003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2276	2344	003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2276	2344	003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2276	2344	003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\003c4954c388677232735d1454e1c0e7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 116
  2⤵
  - Program crash
  PID:2276

memory/2344-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2344-1-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2344-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download