0a467583e6c0582b5a66274e38bb88e6169bff5babfa92e4884414cc9a948dc9

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 04:50

Target

2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe
Size

21KB
MD5

2f0a0bb0096549f742cd10349340a47d
SHA1

f3765768a4e8432fe657d41b92c7239b93a28b55
SHA256

0a467583e6c0582b5a66274e38bb88e6169bff5babfa92e4884414cc9a948dc9
SHA512

79e0fad4525c81945e7f706e42a95c6cabc94b95ce9e7859077ab7e41027ae1638695d47d9a961ef35de725fac6ef9499bab4eb7c192e71d6ae7b6bdc4a053ae
SSDEEP

384:yjEzPdssGWCbp26xrN4v2S2tpbHDzzPIzobBovWFEHLNdshmI6AVoekWxb:yjE7IJbPpWlUpjTAIjFErNGcAq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	1052	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2256	1052	2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe	29
PID 1052 wrote to memory of 2256	1052	2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe	29
PID 1052 wrote to memory of 2256	1052	2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe	29
PID 1052 wrote to memory of 2256	1052	2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f0a0bb0096549f742cd10349340a47d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 88
  2⤵
  - Program crash
  PID:2256

memory/1052-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download