b9e2d54c467b352295f5082d256dcde4c33b96e2b274a7a404a36e89cee82d45

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 08:24

Target

2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe
Size

214KB
MD5

2fa2ce12cb41f56034731d41ba580850
SHA1

d85bb7192e803b1a54834511a52e4af376b80b26
SHA256

b9e2d54c467b352295f5082d256dcde4c33b96e2b274a7a404a36e89cee82d45
SHA512

20712f7ef703abfb4a8b09d0570463cdcfa7db3eb38d2f0979432b07b9d6a15c08649dd74bd9d7a620468ec7db7465e45a7f8d890ce5fcdd6394819e4a3835a0
SSDEEP

6144:TJ358aQFOUv+IA8L29sx0r+GYspv2lYDcBrlAuv/:lc9vlRL2AIgspbIBrll

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2572	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2380	2572	2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2380	2572	2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2380	2572	2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2380	2572	2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2fa2ce12cb41f56034731d41ba580850_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 36
  2⤵
  - Program crash
  PID:2380

memory/2572-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download