8ad024de98b95cb542ee9bc84c658f62e78608c196ebb9bcbaf4c180e646ce27

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 22:46

Target

3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe
Size

24KB
MD5

3f2e09d774a2aae229282560fad8bcc1
SHA1

7b5b7523ca7a39c2866922bc9b84f2bdae32698f
SHA256

8ad024de98b95cb542ee9bc84c658f62e78608c196ebb9bcbaf4c180e646ce27
SHA512

d5dee5da473f9765d50224b0a5e7176dc7f3a355d4dd91c0d7ed7c7d10a370ebd6f9837ad740953a5a862b66b6f8a4de4f4abb6da0dff41c38a0d25f557b508a
SSDEEP

384:mSGJ82mFQ6G9foIwW05CkXEU2Gz9m45HtM6ZsXPr:QiM6GSIwW05Ck/2s9m45NM6C/r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	2192	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1564	2192	3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1564	2192	3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1564	2192	3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1564	2192	3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f2e09d774a2aae229282560fad8bcc1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 88
  2⤵
  - Program crash
  PID:1564

memory/2192-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download