90c2b66a7c6237a384964806cf6943d97ba4558a0bf489b80f14b1f248ce63f3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:14

Target

3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe
Size

32KB
MD5

3667fed9430ea1d0dd54df549e695727
SHA1

3f71fe9837361afa6e94adc0a2934d0465eccfe5
SHA256

90c2b66a7c6237a384964806cf6943d97ba4558a0bf489b80f14b1f248ce63f3
SHA512

a9fd8ef0a1370e42b68903e282e47ed3a686f440648fb5944e369ed497d3d658100d8180dd2c377946109195eaa3c404f1f3d59ff89e368f81bf758fe03f58ab
SSDEEP

192:7pjgKPgsQJhFB3u3tVrHPyp2uu45x7mATwnVpqkC+j6fnj4:7ovmPnATKAT4pqktWnj4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2236 2624 WerFault.exe 3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe

pid	pid_target	process	target process
2236	2624	WerFault.exe	3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe

description	pid	process	target process
PID 2624 wrote to memory of 2236	2624	3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe	WerFault.exe
PID 2624 wrote to memory of 2236	2624	3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe	WerFault.exe
PID 2624 wrote to memory of 2236	2624	3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe	WerFault.exe
PID 2624 wrote to memory of 2236	2624	3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3667fed9430ea1d0dd54df549e695727_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 88
2⤵
- Program crash
PID:2236

memory/2624-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download