c7c1df922f92da2dda48449c49f4bfcea81a6eb9ca8d187b7b1f228beb869ccb

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 23:13

Target

2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe
Size

13KB
MD5

2a1f955905320a67c2d41cdf89a36b69
SHA1

9586e705ec040e1c8e389fa6d74ffdb87e8240f8
SHA256

c7c1df922f92da2dda48449c49f4bfcea81a6eb9ca8d187b7b1f228beb869ccb
SHA512

dd0b2c87370cd931ee4685ddff73f040967bb4c8b7f102f8faa2088929a9c37e49aab64f870697c84faa00f94b64ce37cdf1d66273260df5f7c902bba46748bf
SSDEEP

192:hgLpRRi1ejIjrrWLJqjfj1hJPrdtexWWT5Pfxyw/zsO9XcmD2CGsEDAgm/9G8W9b:hgLnRVsjrBCLfxyGY7m1eAh/8/cotR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2388	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2908	2388	2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe	29
PID 2388 wrote to memory of 2908	2388	2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe	29
PID 2388 wrote to memory of 2908	2388	2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe	29
PID 2388 wrote to memory of 2908	2388	2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a1f955905320a67c2d41cdf89a36b69_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 36
  2⤵
  - Program crash
  PID:2908

memory/2388-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download