a3ea60e92f575debc4ad53b15b9e0731fc2edee1f514f63f3d653d5e06544f3e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 20:06

Target

0a994ca509992205e58c82934a222e24_JaffaCakes118.exe
Size

51KB
MD5

0a994ca509992205e58c82934a222e24
SHA1

537b7abb9ea6538dcdec41b9a8f47869efb3a183
SHA256

a3ea60e92f575debc4ad53b15b9e0731fc2edee1f514f63f3d653d5e06544f3e
SHA512

a91bfff594bd4e35a6be3eeef533d67e0f8c73456bf32d1b5e3b2862ded79898a34fcf2e426e74cc2a418e173784383056c413eafac6870d73e8101f38c45446
SSDEEP

1536:eodZD1kA2fDVSl5Omfxl+UtdbZ498pZLAqOH1l1:JdZDKA2fDVi3fxl+UTbK98pZLu1b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2416	1688	0a994ca509992205e58c82934a222e24_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2416	1688	0a994ca509992205e58c82934a222e24_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2416	1688	0a994ca509992205e58c82934a222e24_JaffaCakes118.exe	28
PID 1688 wrote to memory of 2416	1688	0a994ca509992205e58c82934a222e24_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0a994ca509992205e58c82934a222e24_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a994ca509992205e58c82934a222e24_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 88
  2⤵
  - Program crash
  PID:2416

memory/1688-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download