876e9fc0a4960fba76c36815af144c7af45548488f24f78a1f0c5da0fc82a658

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 00:08

Target

36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe
Size

22KB
MD5

36f3e26dc1c2f933edc36d8c665a6350
SHA1

ca1f508344c08e9580b760b7fdfac0cb441f643d
SHA256

876e9fc0a4960fba76c36815af144c7af45548488f24f78a1f0c5da0fc82a658
SHA512

a1a7c8595eba760e93e5e8ffc8ebeb19f22db55a58c67b25570f32a2ee0393f546079790b7b3e3c7e3fd2020da694474fbca691fcea1a94e132bb72a1325a8cf
SSDEEP

384:DoLBy1ice5/vhbbSiKmyB0qHuALSgXov9+Ntt4he497rsjFOAOhmpd6k:Dsgsx5hbDK/Br/+ZDPa9J6k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	580	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1696	580	36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe	29
PID 580 wrote to memory of 1696	580	36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe	29
PID 580 wrote to memory of 1696	580	36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe	29
PID 580 wrote to memory of 1696	580	36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36f3e26dc1c2f933edc36d8c665a6350_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 144
  2⤵
  - Program crash
  PID:1696

memory/580-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/580-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download