d69a5e17f88bbada466bab2abf9fac5679847d05facf53a3b2f6fe960ff4092f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 19:31

Target

3614ae5f21648425969ad58507769971_JaffaCakes118.exe
Size

17KB
MD5

3614ae5f21648425969ad58507769971
SHA1

ecff07bb6431634e57fbb59c0fd3a727289c77ba
SHA256

d69a5e17f88bbada466bab2abf9fac5679847d05facf53a3b2f6fe960ff4092f
SHA512

126a5024d2ff9c1cec6975e3a7cf9ffeb7b24cf020c231b9d81afb276bfc252d9ea7961d4281e4627adcc0069d6cb317f2d3fb46b908b251cd7f201563bf761a
SSDEEP

384:+lLE/zUAkyM1MpEYjiYqZtEXixOC0Z1QbQ0cAKHjSx4YTQwx9HkF:3NfpEYxqPEXkkIcAKHjU4YTvxd2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	2032	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1896	2032	3614ae5f21648425969ad58507769971_JaffaCakes118.exe	30
PID 2032 wrote to memory of 1896	2032	3614ae5f21648425969ad58507769971_JaffaCakes118.exe	30
PID 2032 wrote to memory of 1896	2032	3614ae5f21648425969ad58507769971_JaffaCakes118.exe	30
PID 2032 wrote to memory of 1896	2032	3614ae5f21648425969ad58507769971_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3614ae5f21648425969ad58507769971_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3614ae5f21648425969ad58507769971_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 36
  2⤵
  - Program crash
  PID:1896

memory/2032-1-0x000000000F470000-0x000000000F47F000-memory.dmp

Filesize
60KB

Download
memory/2032-0-0x000000000F470000-0x000000000F47F000-memory.dmp

Filesize
60KB

Download
memory/2032-3-0x000000000F471000-0x000000000F47B000-memory.dmp

Filesize
40KB

Download
memory/2032-2-0x000000000F470000-0x000000000F47F000-memory.dmp

Filesize
60KB

Download