9611cda2db96e4972f8fa29f9501d9315dbf8fb859535eb93ea59f3648bbdac4

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 18:21

Target

292842b7429a9d07154870e1487ef556_JaffaCakes118.exe
Size

120KB
MD5

292842b7429a9d07154870e1487ef556
SHA1

cf8c1da9725b909c594f2e63d895f3c099e868ed
SHA256

9611cda2db96e4972f8fa29f9501d9315dbf8fb859535eb93ea59f3648bbdac4
SHA512

b1aecb5ffada34740a876280d4d6ca4231be7e9a23e9c2d84b74d71b9f87cf3b6cc27d484aebff9b69521345d534134ac19252b92ee32d850ec031edf6bf8f07
SSDEEP

3072:rBgjSy9D4txAwXWmBQO26ICuYNOlM9Pdk4+1KUk+r2Ne:PyAdWOj+YaMjk4+B+e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1796	2540	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1796	2540	292842b7429a9d07154870e1487ef556_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1796	2540	292842b7429a9d07154870e1487ef556_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1796	2540	292842b7429a9d07154870e1487ef556_JaffaCakes118.exe	29
PID 2540 wrote to memory of 1796	2540	292842b7429a9d07154870e1487ef556_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\292842b7429a9d07154870e1487ef556_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\292842b7429a9d07154870e1487ef556_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
  2⤵
  - Program crash
  PID:1796

memory/2540-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2540-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download