4364f9fc1cc7fd4ddb4bbe69f87ba613d7e7053db817433ed0b32a494ff94dd8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 09:00

Target

2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe
Size

52KB
MD5

2fbe095c466fa53c0f19292f9b8ebc65
SHA1

3154b1a89890879b62835a0615556e98be754b64
SHA256

4364f9fc1cc7fd4ddb4bbe69f87ba613d7e7053db817433ed0b32a494ff94dd8
SHA512

e6630131475181b4fe5c378904670578a978763cfcf1c90c7d31c21ba484c45150535108a513eed0ae74bd02c3024f79f5fa8b65b64237193cababcd0b2d824e
SSDEEP

1536:Vzr4Mzh5N4iOvgOWqZi+LNwyKJ7WsKjR+i5dP:VzrJ5uiMgO7tMtiwi7P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	1988	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3064	1988	2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe	30
PID 1988 wrote to memory of 3064	1988	2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe	30
PID 1988 wrote to memory of 3064	1988	2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe	30
PID 1988 wrote to memory of 3064	1988	2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2fbe095c466fa53c0f19292f9b8ebc65_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 88
  2⤵
  - Program crash
  PID:3064

memory/1988-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1988-1-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download