f6e764417d4cf9f33f33db2b693fa3bc675ebb636d09219eda81f97ba2553573

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 05:59

Target

036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe
Size

192KB
MD5

036fc7b299c22a5e7bf60de7c7335f17
SHA1

b32b632d2cc2e5583dfaa7a0b6530666c703cf08
SHA256

f6e764417d4cf9f33f33db2b693fa3bc675ebb636d09219eda81f97ba2553573
SHA512

f513d1d702d921e210bb8dc35b16e666fe4f8981ab280ce59cdb634770618ef45e335f7e757102971400f1d8f2440cae8f18f963a2c7c4550dc788d7ea98bd98
SSDEEP

3072:s2aCYfrbwgDO8Wwi81SUHFJV7VDgTMagiuygIYdjzOHKXU3qdncwKrF/s:pY/wgq55cSWFJVlC9sIYdjzOHg7ncjNs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2068	2912	WerFault.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2068	2912	036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\036fc7b299c22a5e7bf60de7c7335f17_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 260
  2⤵
  - Program crash
  PID:2068

memory/2912-2-0x0000000000230000-0x0000000000267000-memory.dmp

Filesize
220KB

Download
memory/2912-1-0x0000000000230000-0x0000000000267000-memory.dmp

Filesize
220KB

Download
memory/2912-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download