e242e732c9158bfcc36817e227d17605de77145eb111436c231737083b6cdf0f

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:03

Target

3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe
Size

45KB
MD5

3364ea5e5e263e165747b140e3ee39c9
SHA1

6256d681edbb4f306136788052eea3937808df55
SHA256

e242e732c9158bfcc36817e227d17605de77145eb111436c231737083b6cdf0f
SHA512

f02aff7fdf0bde2560cf9ee9e7a3fc6363ae2677e89a833f4f198df9ae279096bc57616e4b6e82d64ad86ba1966001914d7a138a198515d98ea9c85858e784d6
SSDEEP

768:0fzTM/u4UCNECSoIldfa6Mc8R30NdRhu78BfbnJeJEma/2F2LqslxKha5b:0bDSStllCc8WNdusTJMb0qJe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2704	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2712	2704	3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2712	2704	3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2712	2704	3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2712	2704	3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3364ea5e5e263e165747b140e3ee39c9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 88
  2⤵
  - Program crash
  PID:2712

memory/2704-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download