0711eeff17dc30275d8b5a76b0e650aa305b79605c991aa555004645fc928766

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 21:48

Target

3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe
Size

49KB
MD5

3ad62dbb3a75e3ed1ef4dcefe3e162ea
SHA1

4b7afc57108da57970c655645b35ba3c689cd724
SHA256

0711eeff17dc30275d8b5a76b0e650aa305b79605c991aa555004645fc928766
SHA512

085b77d7b2a7e9802e084fb348535f697c22537ef5d39ef46eedc8c9df9fbb8a90932e5a8ff8d7e72fa12bbbfb321276d2877755762efa4bcbaa1ff06b664233
SSDEEP

768:VYV7Rmgxdyx7IOVs3YaEJUuXaOEAYD9eh0z77Kci5nbR9AnaUCa8GXfuIJJuk:VYpsgC7Rs4Uk8mMiRbR9AUd1k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	2404	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1672	2404	3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe	30
PID 2404 wrote to memory of 1672	2404	3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe	30
PID 2404 wrote to memory of 1672	2404	3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe	30
PID 2404 wrote to memory of 1672	2404	3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ad62dbb3a75e3ed1ef4dcefe3e162ea_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 152
  2⤵
  - Program crash
  PID:1672

memory/2404-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2404-1-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/2404-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download