38c93f9557eccb807549020c78028f2d426751b9f70ac0bd2e354f1857454e23

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 20:15

Target

0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe
Size

261KB
MD5

0aa3b69864715000cc88f04e3adcf703
SHA1

853fcf8b99b6477715e6406faada82978724f959
SHA256

38c93f9557eccb807549020c78028f2d426751b9f70ac0bd2e354f1857454e23
SHA512

e453fb6534a3bcee49906f32af86529be209fdef198dea0f245e8f98d29f52a65c2b785f883e90e04cd0d0b466289b433944c5f9245e2702a953188842a42a9b
SSDEEP

6144:hccRtumLNIjiELjHqOSvXzh2Vajb6/NBZvfBZu:h/R8mLNIjjqxDA0jANvru

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1896	2224	0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe	28
PID 2224 wrote to memory of 1896	2224	0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe	28
PID 2224 wrote to memory of 1896	2224	0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe	28
PID 2224 wrote to memory of 1896	2224	0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aa3b69864715000cc88f04e3adcf703_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 148
  2⤵
  - Program crash
  PID:1896

memory/2224-0-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/2224-1-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download