c7f4a33670be0b9764b2220c2571ccc6c5e7edbed418a47b2d15e168c3856d94

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 19:09

Target

270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe
Size

670KB
MD5

270f720c3216ea5edcb413a65a4920ba
SHA1

3d8fe322610d1d5827227ecb33557ec76a9604fa
SHA256

c7f4a33670be0b9764b2220c2571ccc6c5e7edbed418a47b2d15e168c3856d94
SHA512

d12353eb9eacfc47f44ad8a6520dcdb350d75ac86863bfdf635cd7fbd1863e60810fd86cecdac943fc72a78020c3714a67480f804f289faf5fc2b7c1966682db
SSDEEP

12288:A13KaHVyiNrukxm7BWqV0pDA0rgMHOpq/5OE8Q6SSTUA:AVKGVvukxm7BcDAMpHL8vQ6Lv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2084	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2516	2084	270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2516	2084	270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2516	2084	270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2516	2084	270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\270f720c3216ea5edcb413a65a4920ba_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 120
  2⤵
  - Program crash
  PID:2516

memory/2084-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download