fd79bd825959cb4cfa0c10be156945f5f5c94d9bca799cdc8d04e814f02ef490

Analysis

max time kernel
23s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 02:46

Target

3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe
Size

126KB
MD5

3bb61123622e35197c1a9a8df3a0c57d
SHA1

c145b00f74d303a807e6178e82d5ae802840ad63
SHA256

fd79bd825959cb4cfa0c10be156945f5f5c94d9bca799cdc8d04e814f02ef490
SHA512

1c437adcc796f59c428d6882671ad1a1d63d34908cca4bc4aa9dacec85a1ab496ad42c5d778dd0369768249b143f51a7959f75631e1799c0090a57b8deb76d66
SSDEEP

3072:x6DVJ7365d714eOcBN8EzDdGJNGtERdlJnPAKkK5i:xqR3WXNomtulGKPM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2292	2540	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2292	2540	3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2292	2540	3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2292	2540	3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2292	2540	3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bb61123622e35197c1a9a8df3a0c57d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 36
  2⤵
  - Program crash
  PID:2292

memory/2540-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2540-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download