5468c2d4f5208e2d36f2d1f9697b2ad62a3190b82d1cd0a43319e7ab5eabf720

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 04:56

Target

2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe
Size

113KB
MD5

2f0dbd3f1ea3ee00de62c7c7f33ab8ca
SHA1

5ef92dc158579313120829097f70e00139e63b81
SHA256

5468c2d4f5208e2d36f2d1f9697b2ad62a3190b82d1cd0a43319e7ab5eabf720
SHA512

2ac107d3277519df6c7e9588a43439486bee07a18e36d100715e482395ea568f9cade19d190429dda38681df0dc010f67be19aa2116d67f0e1f234ac0572660c
SSDEEP

3072:J4c4n6tm8n1lQVfNroFEUrSvOXlC/qxaW+Pv:yc4n6ttcNrsl9xaW+X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	316	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1724	316	2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe	30
PID 316 wrote to memory of 1724	316	2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe	30
PID 316 wrote to memory of 1724	316	2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe	30
PID 316 wrote to memory of 1724	316	2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f0dbd3f1ea3ee00de62c7c7f33ab8ca_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 92
  2⤵
  - Program crash
  PID:1724

memory/316-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download