b25c845d42aba0f4133364b071fe2f4f5e41ca326078e63b1f9d55427358b532

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 01:40

Target

3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe
Size

129KB
MD5

3b894aed09c5bbd3dd4e8b502e8c31b9
SHA1

a2fcab41e371e1f7e3227fd903749da1a1a4cc1d
SHA256

b25c845d42aba0f4133364b071fe2f4f5e41ca326078e63b1f9d55427358b532
SHA512

a5773573e2e1fecf2435dfdfdd561a7c44afb51acce57aac31b7750bf5f707e3ad5c8c6444adc258dd59afcef5b155f314268071b5ad8a971ca5a01ed70e06b4
SSDEEP

1536:xuRHOWAA0J9qOmgjxOqPEYqqmP1xha5J7e:kHOWAA0XWgsk/qqmTha5p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	1940	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2764	1940	3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2764	1940	3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2764	1940	3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2764	1940	3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b894aed09c5bbd3dd4e8b502e8c31b9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 148
  2⤵
  - Program crash
  PID:2764

memory/1940-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1940-1-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1940-2-0x0000000000401000-0x0000000000422000-memory.dmp

Filesize
132KB

Download
memory/1940-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download