3755dd4eff3d3ac135e04c64b0fe17608f88e0b2d120ae944943bdf7fc4b7f95

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 05:15

Target

24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe
Size

28KB
MD5

24c176c28dc0ae931c3c34594ae17a0e
SHA1

a651c17a5a77ca288674d71d502a4b8d50689bd2
SHA256

3755dd4eff3d3ac135e04c64b0fe17608f88e0b2d120ae944943bdf7fc4b7f95
SHA512

3be2824a54c31f3d96bd570712cea3b40239c54f1f807b882e3713d257016160a084635690bd7f852712f99fdec978eef379da3b2bf7bb6972011272170dd87c
SSDEEP

384:4CqzIgP9iM4MIKSzz81yF5GF/pQGGNzTRW:jVgP9FTSXKyyRIzl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1720	1856	24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe	28
PID 1856 wrote to memory of 1720	1856	24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe	28
PID 1856 wrote to memory of 1720	1856	24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe	28
PID 1856 wrote to memory of 1720	1856	24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24c176c28dc0ae931c3c34594ae17a0e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 88
  2⤵
  - Program crash
  PID:1720

memory/1856-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download