c759cbabd1d7a930e9edd7cc85db3f7d4bb550d21a51fbaba6c5095e84e565d6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:33

Target

38f2174a819ff5975ac179239368045f_JaffaCakes118.exe
Size

17KB
MD5

38f2174a819ff5975ac179239368045f
SHA1

89ab4c1889a21b28574322d2c6358bf1b6ef791e
SHA256

c759cbabd1d7a930e9edd7cc85db3f7d4bb550d21a51fbaba6c5095e84e565d6
SHA512

36765092f526d2097155f162a98f532f1f9ad7811cb4cc5feb0b54ca300cbb78d798efdf3109e70047f485416a318645f41cb5bc240b040dd5e543adadd822ba
SSDEEP

384:yzF+N0uo1mbc61QiAT1uWtyqJ8tlg+Z0xX0VB4PRsJSF:I4i1mblcbwqJ06uQX0UsJSF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2120	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2696	2120	38f2174a819ff5975ac179239368045f_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2696	2120	38f2174a819ff5975ac179239368045f_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2696	2120	38f2174a819ff5975ac179239368045f_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2696	2120	38f2174a819ff5975ac179239368045f_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\38f2174a819ff5975ac179239368045f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38f2174a819ff5975ac179239368045f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 88
  2⤵
  - Program crash
  PID:2696

memory/2120-1-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2120-0-0x0000000000400000-0x000000000040D6D6-memory.dmp

Filesize
53KB

Download