e7ff3d7328fbe520d4b818225bd2c4a6a599ba0c5cf555327c346a0bee9f925d

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:25

Target

38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe
Size

116KB
MD5

38617ef070c88166a506464aba53b5f7
SHA1

d8d8f8c88270a65c080c6de636794250276341ed
SHA256

e7ff3d7328fbe520d4b818225bd2c4a6a599ba0c5cf555327c346a0bee9f925d
SHA512

670b835007253b51f90beab278081260194240fe83235d3a25fa77e327f64058940556eeb3cea8743abe43f25d94bdfd6a81f1229707db9e3c281072fcb3c824
SSDEEP

3072:CGOvDMBf6wAuJB+fC4bnDqApcjX8BN+cY9jW:FCCf9A6wC4bDHps8BcljW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2816	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2824	2816	38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2824	2816	38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2824	2816	38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2824	2816	38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38617ef070c88166a506464aba53b5f7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 36
  2⤵
  - Program crash
  PID:2824

memory/2816-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2816-1-0x0000000000405000-0x000000000040A000-memory.dmp

Filesize
20KB

Download
memory/2816-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download