419e9e16793b5ce93c731d390f2e90efe72f1a2a3531fc29058281ced664728f

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 13:55

Target

396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe
Size

383KB
MD5

396870745be834ac33dc87fcd5e75a44
SHA1

3159a4957099d5a078a9d7c4ff2885d8a5823af4
SHA256

419e9e16793b5ce93c731d390f2e90efe72f1a2a3531fc29058281ced664728f
SHA512

459b7aac197e526f6fd7cfc8abb491d566bbba79a811676aba2a230561475d7b2552796b204d8104c13fe9de8fe573c4c6de195464e720b0e2413dd77c386d92
SSDEEP

6144:bquvoUA92zkAITOM5WhBTbwGIkcKMnrZYArQQglFW5hIHxSVHepD4lNh:GuwUuAkA/V4kcKMrnrpgiL0sVHepMlNh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	2160	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1328	2160	396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe	28
PID 2160 wrote to memory of 1328	2160	396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe	28
PID 2160 wrote to memory of 1328	2160	396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe	28
PID 2160 wrote to memory of 1328	2160	396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\396870745be834ac33dc87fcd5e75a44_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 52
  2⤵
  - Program crash
  PID:1328

memory/2160-0-0x00000000004D0000-0x0000000000532000-memory.dmp

Filesize
392KB

Download
memory/2160-2-0x00000000004D1000-0x0000000000530000-memory.dmp

Filesize
380KB

Download
memory/2160-1-0x00000000004D0000-0x0000000000532000-memory.dmp

Filesize
392KB

Download