926e81ed5dab2238931f8a0ab8a2ad2c06ce56c5fb6d92eee78e0068e9942780

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 11:26

Target

302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe
Size

196KB
MD5

302eb1b88383515c180a15ee01b42288
SHA1

ee1e885a8da557e55a55bf3c06d9e10c8f8f0a97
SHA256

926e81ed5dab2238931f8a0ab8a2ad2c06ce56c5fb6d92eee78e0068e9942780
SHA512

edafab68103704ca27ee99185bda9a770c5f84b1884b6472d17959b06166ddf79086d5141a5273f4a9156ff11edc18fbf87f5e3972c7718b879557d090961efd
SSDEEP

1536:rH9BLIl2CfCgF9G0KKe4yyMht1yEuzOYt8rPHs:RBLIlZFlKKekMP1ylF+rvs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1828	2392	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1828	2392	302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe	30
PID 2392 wrote to memory of 1828	2392	302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe	30
PID 2392 wrote to memory of 1828	2392	302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe	30
PID 2392 wrote to memory of 1828	2392	302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\302eb1b88383515c180a15ee01b42288_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 36
  2⤵
  - Program crash
  PID:1828

memory/2392-0-0x0000000000400000-0x0000000000431200-memory.dmp

Filesize
196KB

Download