352aaf0536b8a41421b299d375b88cdecb3baff2eb369657cee7ec93ac11e408

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 21:03

Target

263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe
Size

368KB
MD5

263371fca7675ebf216c64e9bbf84ce5
SHA1

e83dfb5759f79a03ab025505880233e47102e4aa
SHA256

352aaf0536b8a41421b299d375b88cdecb3baff2eb369657cee7ec93ac11e408
SHA512

d356f51cb92703fac1060fc550cb4aea953255b68c32053e96f02178ec64ac4d3ebbed4349950e21bbf96ecf569384753132bd869770495b0c760a8280a11a32
SSDEEP

6144:y5rCswCny7EDGoR+FuO4zK01DS9K1ap/HbTVPCWxXk950ibvZ0ZdD9Qeg/:y5rCsNny7Nu/zK01S9KsvbhaiU950egI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2372	1044	263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2372	1044	263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2372	1044	263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe	28
PID 1044 wrote to memory of 2372	1044	263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\263371fca7675ebf216c64e9bbf84ce5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 44
  2⤵
  - Program crash
  PID:2372

memory/1044-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1044-0-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1044-2-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1044-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download