524b0198687286585d3b2cfeaf260940ea44bc041fe41057d6523fecd47c8146

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:15

Target

1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe
Size

116KB
MD5

1a41ee57da54149b579966c3421b90e4
SHA1

a40a31f206df854d8574ed8e84506d2eabf0f77b
SHA256

524b0198687286585d3b2cfeaf260940ea44bc041fe41057d6523fecd47c8146
SHA512

754ffaaf35f187b47cc48e0001c9a22cbd84c7cab444794ec6de146abda37996c13d74b5c9c311a4bc727ec8dceab815c830107e36ed184a81dd48e835cfb26f
SSDEEP

3072:yAI68F8b6POQYeD65Ji4K7KIQrNS1e35MTAJ:B46ePO3eK44K7Qr+auAJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3004	2936	1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe	28
PID 2936 wrote to memory of 3004	2936	1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe	28
PID 2936 wrote to memory of 3004	2936	1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe	28
PID 2936 wrote to memory of 3004	2936	1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a41ee57da54149b579966c3421b90e4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 36
  2⤵
  - Program crash
  PID:3004

memory/2936-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download