45e88b1601d70fe62ad1ebb7745be3115280682603059c6acb47b5ebc62c670d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 19:51

Target

3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe
Size

99KB
MD5

3624d6a35f05aac1418cc22ae5b62127
SHA1

803bfda0c5b9ea6174f8b60e03466be80ad568cc
SHA256

45e88b1601d70fe62ad1ebb7745be3115280682603059c6acb47b5ebc62c670d
SHA512

c4e19b665b05f98730ffbe671f749a9a773966210239cb8d8c3162a631bfd49950220533bc4649ecf0fa79e4d8bca260afb812b2c59951da5f450e463c20e8d1
SSDEEP

1536:KOC9rM+bC3mw3Boi1ZKwasjey3/jiu42RvcKDQyadfVQoe2a/Vbg0NEq/knz0:KOT+bCWw3h1zaK32J2XQVCrn/Vd/W4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	2756	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2624	2756	3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2624	2756	3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2624	2756	3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2624	2756	3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3624d6a35f05aac1418cc22ae5b62127_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 168
  2⤵
  - Program crash
  PID:2624

memory/2756-0-0x0000000000520000-0x0000000000535000-memory.dmp

Filesize
84KB

Download
memory/2756-1-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download