39718fd56e6fa0228f46b1eef8d6a445bbbd36a2679c97d52aad7a8f481a300b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 13:47

Target

068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe
Size

10KB
MD5

068dbb8a98c1f67c17a4d6f965d6c4e7
SHA1

296a62f581a0ab71ca58d4441dc320e41dd166a6
SHA256

39718fd56e6fa0228f46b1eef8d6a445bbbd36a2679c97d52aad7a8f481a300b
SHA512

f51647330f9d1c20fd6ce899eef7d02da16be500b3950aee79e25230bbbb8897f5dfd8ad86c503086e8f0d955de02e43a39396b50c6ee51e513d1c9254577170
SSDEEP

192:eN+fAT7fzJpnkwPFPnnZag7DJJtOs/LFpZMHE9LTQu33ClnmdvyCGN5u5Ve2p:OsAT7fdpkQFPnZdD3tTLFPMHyMxUdvyI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1056	1476	068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe	28
PID 1476 wrote to memory of 1056	1476	068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe	28
PID 1476 wrote to memory of 1056	1476	068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe	28
PID 1476 wrote to memory of 1056	1476	068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\068dbb8a98c1f67c17a4d6f965d6c4e7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 140
  2⤵
  - Program crash
  PID:1056

memory/1476-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1476-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download