a97706f5935c53c82376a4329d2a76f7bf0408e11523adfe6d47848442b27eff

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 06:01

Target

24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe
Size

435KB
MD5

24df42685a5425f8f385d95ff38d4af1
SHA1

7b96841afbf181340324444185115f577fe2a767
SHA256

a97706f5935c53c82376a4329d2a76f7bf0408e11523adfe6d47848442b27eff
SHA512

ac7e73acc59ebd1aff7d205276da7cf532d72ab96ee58892dbbb4e826de15c43929d774893955d8d84bde7570db4ee638f82d2904fcd7764440a100e63faced1
SSDEEP

6144:5S6ILyXsBtEc+DsiZXGopfS0BzMUp1O1FXTKDrKqZXEZl9BW4MO9rE7:5YWcEc+4iZXX17uEh8lm4DVC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1544	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1548	1544	24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe	28
PID 1544 wrote to memory of 1548	1544	24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24df42685a5425f8f385d95ff38d4af1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 120
  2⤵
  - Program crash
  PID:1548

memory/1544-0-0x0000000000400000-0x000000000046CCE0-memory.dmp

Filesize
435KB

Download