45b80e9f8561880457308b5a55a445181367b9b85c4ad9287fa6f06b6f645328

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:28

Target

3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe
Size

12KB
MD5

3378e42cd6c49136b47dadb313b1e66d
SHA1

597aad9d0cac6ec0e2be56d6915e0620d90770a5
SHA256

45b80e9f8561880457308b5a55a445181367b9b85c4ad9287fa6f06b6f645328
SHA512

964ad7816a914a37117008c429ec4e8c387bf009ae0e7a73af3c08812d73e37f0578d928f4958119196333e74f25e4a6da259d0588e268bdbdb29e3bc1b7dc46
SSDEEP

192:OQe/eg0Fs1dkVQ2tc8FqDQqJ2PiuIKoCXOtAxzzcKmDNww6HWeycC3uT:tAeQ6c8FYVJmtIWXOtAVzcfa2eTv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2548	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2412	2548	3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2412	2548	3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2412	2548	3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2412	2548	3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3378e42cd6c49136b47dadb313b1e66d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 44
  2⤵
  - Program crash
  PID:2412

memory/2548-0-0x0000000000400000-0x00000000004063BB-memory.dmp

Filesize
24KB

Download
memory/2548-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download