34e4f0865908240bd54b5fa6c21c930d5823cb1c49e4f382e3a2e5dba834a793

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:24

Target

05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe
Size

370KB
MD5

05f5e706bb0b1c1c5a84032dd2a7a971
SHA1

95e3a87aa3d0194eb7d62fbd59414189ed1c3baa
SHA256

34e4f0865908240bd54b5fa6c21c930d5823cb1c49e4f382e3a2e5dba834a793
SHA512

4e3c2524541e6db83c5198452415b603e21a2478435c0c1297a42a2e2ace9e9d7cf708ced19501ae5c67d80ebb74b4ce14f64ef24bc35e8334363753bac35fe9
SSDEEP

6144:Wm62ozgL7rEEWUBCko3z8h2pvtekIYkFkPFLScxZL7tAlBDwRB1BirDkjHg0+zb7:ULML7rEZkU02pvLbkSPBScztAlB8urDM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2864	1908	05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2864	1908	05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2864	1908	05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2864	1908	05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05f5e706bb0b1c1c5a84032dd2a7a971_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 88
  2⤵
  - Program crash
  PID:2864

memory/1908-3-0x0000000000400000-0x00000000005240B8-memory.dmp

Filesize
1.1MB

Download
memory/1908-2-0x0000000000400000-0x00000000005240B8-memory.dmp

Filesize
1.1MB

Download
memory/1908-1-0x0000000000400000-0x00000000005240B8-memory.dmp

Filesize
1.1MB

Download
memory/1908-0-0x0000000000400000-0x00000000005240B8-memory.dmp

Filesize
1.1MB

Download
memory/1908-4-0x00000000004C2000-0x000000000051E000-memory.dmp

Filesize
368KB

Download
memory/1908-5-0x0000000000400000-0x00000000005240B8-memory.dmp

Filesize
1.1MB

Download