ed082c3b2810be8c7ac70eeedddb94db938cc941ced1b2331805cced31814194

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:23

Target

2f74c58519626786572c7613372a6250_JaffaCakes118.exe
Size

56KB
MD5

2f74c58519626786572c7613372a6250
SHA1

bde52ba4233f82b27c83eefb756e78077744f440
SHA256

ed082c3b2810be8c7ac70eeedddb94db938cc941ced1b2331805cced31814194
SHA512

4bf63d7430a4ff5f91846822ee6dc0d01b7e9f98350192493d8f4809a7330bea6fe6b72e8b12e8e6eec13f095ed8fbb058d438ecc52fe89446f5d4f94cd263b6
SSDEEP

1536:6dScQHcGyARfjW3U9EbgXEIfFJtVDFltsLuDKN1:QQ8yW3KkgXEmdVDFl+Luu1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	1704	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2344	1704	2f74c58519626786572c7613372a6250_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2344	1704	2f74c58519626786572c7613372a6250_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2344	1704	2f74c58519626786572c7613372a6250_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2344	1704	2f74c58519626786572c7613372a6250_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2f74c58519626786572c7613372a6250_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f74c58519626786572c7613372a6250_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 36
  2⤵
  - Program crash
  PID:2344

memory/1704-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download