bbcdf3e35d1f0ce930ec82103474ea613c6731bdd8686c968de5ac9d0c56be30

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:29

Target

375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe
Size

76KB
MD5

375c5bec20569d655570a58f8471c57b
SHA1

7c4c00b7ccb6101b4567d514473f5c3c8f95929d
SHA256

bbcdf3e35d1f0ce930ec82103474ea613c6731bdd8686c968de5ac9d0c56be30
SHA512

a65da01e761323beb67bb54c4f552a7014d32cc186551d86e65ec28ca8c20bb8ae3b026e357a4d15b0e4da700824cbfade8e80a1eef76687bac7f8d4dee4b269
SSDEEP

1536:FPr+w62GvmKBe0bUDE6KoUuXZALSxgt9srtWPpZQzj:FPr+12G3e0ADEe/aZQzj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2696	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2736	2696	375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2736	2696	375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2736	2696	375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2736	2696	375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\375c5bec20569d655570a58f8471c57b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 88
  2⤵
  - Program crash
  PID:2736

memory/2696-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2696-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download