b098027b272bca5f5be4244e3d7783402c0f8ae62cd34af721cfed68ec094186

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 20:13

Target

261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe
Size

330KB
MD5

261d606d2a966f7e81b696d608d1a34e
SHA1

4df5f3e3a0f8abae271566102263ba0814d17bb6
SHA256

b098027b272bca5f5be4244e3d7783402c0f8ae62cd34af721cfed68ec094186
SHA512

42be6e7da3b7114a9f207bbc2715c772ae41b1e469cd9af0a6c99f29a3c0bcd994d7ee4375c9f92d8e20786d9e43850c6ded13afc5d5fa079c0ab27006bcfbc1
SSDEEP

1536:cCO1Pt8jhwii9FCl+wWPf0/hehvcobVXEjcAq:cCO1Pt8dwii9FC3WPf7cMVXH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	3040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3052	3040	261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe	28
PID 3040 wrote to memory of 3052	3040	261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\261d606d2a966f7e81b696d608d1a34e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 36
  2⤵
  - Program crash
  PID:3052

memory/3040-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3040-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download