c2d3b5778a550d704683cec1c7e3771eb35791569fd4aa9c5317f9e04f10c153

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 00:46

Target

3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe
Size

30KB
MD5

3b602cfc40e4849e36365cf8486d6dde
SHA1

e3b6de04afc81925d830af28a7eefdddacbd7cb4
SHA256

c2d3b5778a550d704683cec1c7e3771eb35791569fd4aa9c5317f9e04f10c153
SHA512

89609256d5e2bcc92eebd75797c2fa33d021a99a7ef2ee3e718e8b7b12223d402952e2f0c7ad715a02c2e3109b186d378c7b5cec32a95635bbcf9c0b6f169024
SSDEEP

384:+PoAQ8VUVdE29PB5+XLrhx2xAp8yhPHGQZ5+eebNAHZgTqBr:+PvUVjf4XZb8avG05+8iG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	1868	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2856	1868	3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe	30
PID 1868 wrote to memory of 2856	1868	3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe	30
PID 1868 wrote to memory of 2856	1868	3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe	30
PID 1868 wrote to memory of 2856	1868	3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b602cfc40e4849e36365cf8486d6dde_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 36
  2⤵
  - Program crash
  PID:2856

memory/1868-0-0x0000000000406000-0x000000000040C000-memory.dmp

Filesize
24KB

Download
memory/1868-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download