b8575ebba473fc2d342b239bc7b85050d1eedb971a95357307e518b9a205ad1d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 01:54

Target

29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe
Size

293KB
MD5

29a889886df0bdab0dbb9d85b69518ce
SHA1

162881f04376a62ceeb9366659dec1e2db2474c2
SHA256

b8575ebba473fc2d342b239bc7b85050d1eedb971a95357307e518b9a205ad1d
SHA512

0a836f97c62b429ebd80f75b0a82b9a2906fec88cb9a191a174c6464c6e1c8b8885c4a229e4c801a3d9dce7086a55d97a86847906b324ec75a9f9e0bce19dc1a
SSDEEP

6144:Wb7J6Hj/bcbAxx8ehRr48WfNAwqBEwmp4cNGh7+7E:O7Mc8DWfNA64cIg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
888	1852	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 888	1852	29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe	28
PID 1852 wrote to memory of 888	1852	29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe	28
PID 1852 wrote to memory of 888	1852	29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe	28
PID 1852 wrote to memory of 888	1852	29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29a889886df0bdab0dbb9d85b69518ce_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 200
  2⤵
  - Program crash
  PID:888

memory/1852-0-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/1852-1-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download