4afae48c1417eb3a00519fda4a961701237348d94b6e3a48fa469eb97e785f27

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:48

Target

3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe
Size

43KB
MD5

3aa92c0539f05f8f2c71dde30727c028
SHA1

6f821d7f59566c0e2bd217c80c13e82ccab3076c
SHA256

4afae48c1417eb3a00519fda4a961701237348d94b6e3a48fa469eb97e785f27
SHA512

fb942c5252f163ae9f901541c26abaf53e3c90476394cc386baf4f849668b945a98fd223fa40b6896a55460967e7a8d1bddf00ed823441092ab6a0b768ab1c42
SSDEEP

768:D4WVG0xBuBt+2FEB1yBsw+NVqh5J/JCbW4///3po4jsLDqsDA0Ijn:JxB2rETndN0LD4/33po2svqsM0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	2292	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2332	2292	3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2332	2292	3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2332	2292	3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2332	2292	3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aa92c0539f05f8f2c71dde30727c028_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 44
  2⤵
  - Program crash
  PID:2332

memory/2292-0-0x0000000000530000-0x0000000000554000-memory.dmp

Filesize
144KB

Download
memory/2292-1-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/2292-2-0x0000000000530000-0x0000000000554000-memory.dmp

Filesize
144KB

Download