3f27a9707e2007af48a08ff38d820626d04511cac0c59903b433fcc22fa47e4d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 11:32

Target

1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe
Size

256KB
MD5

1b21b8b207a66e0ea328d625631db1dc
SHA1

6b05d11a924b28950a1fab470dd0186c854e2332
SHA256

3f27a9707e2007af48a08ff38d820626d04511cac0c59903b433fcc22fa47e4d
SHA512

92abed88076470b57b8bfd2666b44e8e75ddaa869489367aab4e4c08df1e3c969b65f5b968f292f8ca3bcc02611d056bee50413eb7307f86dc7a261cc873348d
SSDEEP

6144:76vI8yP6E1hU+2Edr2+y0zbKX3ir6fhzo0naGRZ5:mvBySEsHEdr2NioPaGRT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1892	772	1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe	28
PID 772 wrote to memory of 1892	772	1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe	28
PID 772 wrote to memory of 1892	772	1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe	28
PID 772 wrote to memory of 1892	772	1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b21b8b207a66e0ea328d625631db1dc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 120
  2⤵
  - Program crash
  PID:1892

memory/772-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download