dfdfb2edec5eabbfde418250b32e9cb01285d5422f31b2ee41a51a0303bea370

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 09:18

Target

341efd27896baccb84796a6caa319218_JaffaCakes118.exe
Size

104KB
MD5

341efd27896baccb84796a6caa319218
SHA1

a4ad749bfcf67b5dc00598505790d6a7b57ec40b
SHA256

dfdfb2edec5eabbfde418250b32e9cb01285d5422f31b2ee41a51a0303bea370
SHA512

8e2e6471d644f1339b45f890c121325ccb7f53fff6e655c18c67625f555f70ee817cc2799a533d352cdc76bb8f9089f972ecb33e24688b305206f1965ea07cc8
SSDEEP

1536:WiAiUk2Va0vwZzRXk1OJjV5OcI/j6/ju2yjEoXJKXX0JSkRxWMSC7jGN0Wf:WhdkMa8usOxTBI/j6/aBI8uiSiZjGqWf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	2996	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 112	2996	341efd27896baccb84796a6caa319218_JaffaCakes118.exe	31
PID 2996 wrote to memory of 112	2996	341efd27896baccb84796a6caa319218_JaffaCakes118.exe	31
PID 2996 wrote to memory of 112	2996	341efd27896baccb84796a6caa319218_JaffaCakes118.exe	31
PID 2996 wrote to memory of 112	2996	341efd27896baccb84796a6caa319218_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\341efd27896baccb84796a6caa319218_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\341efd27896baccb84796a6caa319218_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 164
  2⤵
  - Program crash
  PID:112

memory/2996-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download