c8489302618f62da9838943079014ec0fd9e5462e500c1447f225514a2aa1e96

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:32

Target

39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe
Size

298KB
MD5

39212a7c673b2fa336c754f9d937fa3b
SHA1

06f3bc882c5efcee455b8c8401f1f9f4d759293a
SHA256

c8489302618f62da9838943079014ec0fd9e5462e500c1447f225514a2aa1e96
SHA512

cd4906a1040ee1ee8cea97e5d18c1092d806d92f23b5951bff6bae3c8237547f5bd4bf49d1de48d80f3e0d526361c88892137dfb16d43d6056d9e4abd0647dd7
SSDEEP

1536:0GLclDc1QnK67wuIpePFC4XvXDVXNNv+8rCly17sy2oU4TWvJzTco/xih6X1uspC:Hog1QK60KH/XDYACcgaQJFJI6sCvrO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	496	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 2548	496	39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe	30
PID 496 wrote to memory of 2548	496	39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe	30
PID 496 wrote to memory of 2548	496	39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe	30
PID 496 wrote to memory of 2548	496	39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 92
  2⤵
  - Program crash
  PID:2548

memory/496-0-0x0000000000400000-0x00000000009F20A8-memory.dmp

Filesize
5.9MB

Download