a29a119cc4be89925ea31d84b8e3c4852be2dcb36d00246c1e6289492882afc3

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 18:03

Target

25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe
Size

786KB
MD5

25b87ea62c5b0c6bb4b3bf99d3720429
SHA1

1ae44cc12b7fd59757b0c491fc07e6e4f2351129
SHA256

a29a119cc4be89925ea31d84b8e3c4852be2dcb36d00246c1e6289492882afc3
SHA512

afa6cdb2dc18bc64238f30a84ad1b8479079e9d18e7806a0c0417dd79fdf807ce970620ba40c91e774e40044147a6374063635ed22f531f9685e355b753a1fbc
SSDEEP

24576:/a/TgJlzZPO1Ynemt0Is3t8Je/kjZa3O8kkUbsSsbcEBqbl/uI+fF/tQAYus+3GG:yMe3Yc3diQj/06DS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2392	2232	25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25b87ea62c5b0c6bb4b3bf99d3720429_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 200
  2⤵
  - Program crash
  PID:2392

memory/2232-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2232-1-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download