4381755f5415e89b9e49f8e6c99b5d774dd64da1b906acb3635aaaa34f468f6c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 11:58

Target

1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe
Size

57KB
MD5

1a077cb530ffe70f23afd3024b415916
SHA1

f5fcc509c9811e96c10cf08b83e132c17181946c
SHA256

4381755f5415e89b9e49f8e6c99b5d774dd64da1b906acb3635aaaa34f468f6c
SHA512

5aac0ab5db6be72e640033ffc23d9ba0664cecebc06915c07bd349722e1fe43132502d529a33a3216cbb4daf3bd2f46008270abbe911197c9b957d11088188b8
SSDEEP

1536:eQdn9QRl6DzZw1Hbzapg86SnQJuun4nkM9d9v:vDDzcH/GxQJ9Js

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1952	2272	1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe	28
PID 2272 wrote to memory of 1952	2272	1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe	28
PID 2272 wrote to memory of 1952	2272	1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe	28
PID 2272 wrote to memory of 1952	2272	1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a077cb530ffe70f23afd3024b415916_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 36
  2⤵
  - Program crash
  PID:1952

memory/2272-0-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download