55e757eeb966e4389ee54fa25bbf401694f6192da5b2796ff6c2d135e8957346

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 16:44

Target

270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe
Size

119KB
MD5

270a3519a8e7eb37a61138fd3cb2a552
SHA1

0a92d07330d5af6c740820d7a0628ad8b3034a8b
SHA256

55e757eeb966e4389ee54fa25bbf401694f6192da5b2796ff6c2d135e8957346
SHA512

5830196e3a5479efcfbf6989974bbdea961a9d86a21cb4ad2c9ffb47a649d73695c3a60e7e3b72364195bfcaafe306616b447b3364ee9013ddefcec2ce7e2735
SSDEEP

3072:NhyVR3H397BpjsokToH3w1VOJOAmEPgrCA7mEjzZt+V:NEnsPTooOJOLEPzAdtc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	1240	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1280	1240	270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe	30
PID 1240 wrote to memory of 1280	1240	270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe	30
PID 1240 wrote to memory of 1280	1240	270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe	30
PID 1240 wrote to memory of 1280	1240	270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\270a3519a8e7eb37a61138fd3cb2a552_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 36
  2⤵
  - Program crash
  PID:1280

memory/1240-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download