b39a300f838449d6c0bdf1a72fb1861927093cb8462e924371b80df2d074a977

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 03:13

Target

2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe
Size

72KB
MD5

2ac9b8202c58d84c8b9c47fd72b6a26f
SHA1

dd5a0650a227cd979e9cbeed567c39fc6da6fc05
SHA256

b39a300f838449d6c0bdf1a72fb1861927093cb8462e924371b80df2d074a977
SHA512

93ca5c694768050268d7a40f26ef15ca6e3d511c501e040a24d4a3fbfd3f8eecef72ba7444697603ac4a4feb7f7de3de4385264ac60ec1344cbf066914de471d
SSDEEP

768:0M7GmjjcjWFXd5RXSj7wlOE1CVG9nAc76BWU4:0kqUN5dBlOSCVBKA4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2872	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2920	2872	2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2920	2872	2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2920	2872	2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2920	2872	2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ac9b8202c58d84c8b9c47fd72b6a26f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 140
  2⤵
  - Program crash
  PID:2920

memory/2872-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download