df18d52572ef8d0800cb31f921958441cb3e88665bfffe38929425afd6639f7b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 13:08

Target

0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe
Size

42KB
MD5

0e3124ffb0cefff3a3aa3667baf21008
SHA1

2ec7376a6124eadfe447fb6ff32baa265dab00a5
SHA256

df18d52572ef8d0800cb31f921958441cb3e88665bfffe38929425afd6639f7b
SHA512

fa4947ea324aa7c066ce2b6d07d41de8b83fd9a631f0c0868988d9df5133efd9cd4a35174d6146f763072716ef33174211cac3db91c8e6c39497fb9da5240610
SSDEEP

768:+HP/i4HmYfZ+jMcI5pNfEAMeM/jkB6ZkhRlqi+KGWtv35BMC:IiGml4c4pBEhewjkgahRlwPWJ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	2424	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2060	2424	0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe	28
PID 2424 wrote to memory of 2060	2424	0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe	28
PID 2424 wrote to memory of 2060	2424	0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe	28
PID 2424 wrote to memory of 2060	2424	0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e3124ffb0cefff3a3aa3667baf21008_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 36
  2⤵
  - Program crash
  PID:2060

memory/2424-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2424-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download