8a4315c8444fce41ed2b849b90d50838dd458987cbb6dfc5b88a84945ebe6299

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:52

Target

31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe
Size

117KB
MD5

31bed667e92cb9d72ce17c8db7c9cb84
SHA1

c00b4cf43a55fc14b68b75d11176763f8ae7018c
SHA256

8a4315c8444fce41ed2b849b90d50838dd458987cbb6dfc5b88a84945ebe6299
SHA512

961c873fc34231f8415fc8bb4fd86dbc70d3eb6de1bae98c07f25b0297ca13c95f9e087fa4d3f4256fd0d5880e1fbcdf5db6c98417cec33d1a82429d18325d8e
SSDEEP

3072:W8ZhoCj3Se20KR3kq8wzz7MuA72VajM3/3n:W8HRo0KJkq8Iz7VA7Fg3/3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2236	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1292	2236	31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1292	2236	31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1292	2236	31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1292	2236	31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31bed667e92cb9d72ce17c8db7c9cb84_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 36
  2⤵
  - Program crash
  PID:1292

memory/2236-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2236-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download