bbdd3b1843f495f65ba257b2de72dff91b127aa82728b1bc43a9710b3b88fb7d

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 05:11

Target

03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe
Size

34KB
MD5

03177be48e0a22a4a31f327384d9b7db
SHA1

0ef1fe20668c91eb7315c35e19966243d6b05b87
SHA256

bbdd3b1843f495f65ba257b2de72dff91b127aa82728b1bc43a9710b3b88fb7d
SHA512

eca9a5421167e3253f9c654611a6ef75a2e917862288069b61c1862120dedf17ff27144981242ddd9b5652b7f78c9f60093810aaed533748eead6e235cc1ee3f
SSDEEP

768:5bD1a7Fbjzurzk0q8Htu4Bpd/C5OV8/blo5Wn:Bg1zqz+4BQOa/blEW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1792	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2392	1792	03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe	28
PID 1792 wrote to memory of 2392	1792	03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03177be48e0a22a4a31f327384d9b7db_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 160
  2⤵
  - Program crash
  PID:2392

memory/1792-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-2-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/1792-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download