cb0bda79f2a7428fff200bb3d2e8f722d11dd9c19c9a0afce24cdb0eaf22d956

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:03

Target

078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe
Size

8KB
MD5

078d42fd7bf08472ab4e958ba870db74
SHA1

d66a47bc9a1c227022f5651f2b43b3a419b19f6f
SHA256

cb0bda79f2a7428fff200bb3d2e8f722d11dd9c19c9a0afce24cdb0eaf22d956
SHA512

fd5c0fb32c042a39ca7c42ea872f52e3f163710d73baaf6ea201ab1bbd99ad0f04a6cf12acb69fb311da0360396bd1c431cbfd6c238834dd0692e481557b132e
SSDEEP

96:jbvEx3Ldajg2WUnVxKXPNxl1+TgHX8EHAkYHAkX:jTG3Zl2LVAfNxl1THsEgzge

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2164	3040	078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2164	3040	078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2164	3040	078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe	28
PID 3040 wrote to memory of 2164	3040	078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\078d42fd7bf08472ab4e958ba870db74_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 36
  2⤵
  - Program crash
  PID:2164

memory/3040-0-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x0000000000400000-0x0000000000402100-memory.dmp

Filesize
8KB

Download