a0829af501be38a90ef5292594a15c5a79ff979fd6be89a055c5941e3a6de17b

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 05:22

Target

032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe
Size

13KB
MD5

032c5b08d304e4b4ee9ec1d75bef1e2f
SHA1

d1d15d193b3e648fbbf241438b863a37b0cf0f23
SHA256

a0829af501be38a90ef5292594a15c5a79ff979fd6be89a055c5941e3a6de17b
SHA512

c5d08de80751e7ffc5239dc3077b24d16a1fa9567d9f1e00ca31ed5c31706581f4b9a99d9a3b80132ff6b28969efa2d67493c826ffcccdfa2ef2a893c5aeeb08
SSDEEP

192:y7Ruuw5L2n0dLu5f/TjNB8OPIvfRgMgc3EKRsdSL8GAGuix3BiLEH8tun2/M:y7IXdi/T3VIvfDndL8rwiE8Y2/M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1996	2012	032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1996	2012	032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1996	2012	032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe	28
PID 2012 wrote to memory of 1996	2012	032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\032c5b08d304e4b4ee9ec1d75bef1e2f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 88
  2⤵
  - Program crash
  PID:1996

memory/2012-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download