8ccad203880658ddd33b022cf47c69a04c9ae0dbdf37eeb0ac8f734bc2b04663

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 21:06

Target

3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe
Size

116KB
MD5

3ab64e696dda47f1cb35902ad66478cb
SHA1

5e525e6a4c72f7ccdfa94c3841c5a8dba8881574
SHA256

8ccad203880658ddd33b022cf47c69a04c9ae0dbdf37eeb0ac8f734bc2b04663
SHA512

2aec8ca10f0935cbf61853c13ff6e20da1192101c46a341b3619c5783121a33ee019d5aecdc457547c9aeb81a74cffcb121ad0e2c94518ee16244678e7997faa
SSDEEP

1536:Ir18cRXI3A4br5tx53HKKWSClxFVKdJXLw+PUTIoHh7u2JCGVF36TAM8uYZ2fxCH:IR4w09tXPWZlvX3soB7uyVCo2E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2424	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2484	2424	3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe	30
PID 2424 wrote to memory of 2484	2424	3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe	30
PID 2424 wrote to memory of 2484	2424	3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe	30
PID 2424 wrote to memory of 2484	2424	3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ab64e696dda47f1cb35902ad66478cb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 36
  2⤵
  - Program crash
  PID:2484

memory/2424-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download