3bba0dbd2af5f49e102f1017a89f94b98ecba026ff35e4f2e56624c645819742

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 07:21

Target

3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe
Size

94KB
MD5

3c74e0a5adcf788cd53ef694413cc34e
SHA1

5078b230a4e9ba07072fe17fb4fac6ace26d2c7f
SHA256

3bba0dbd2af5f49e102f1017a89f94b98ecba026ff35e4f2e56624c645819742
SHA512

ff14d72efc0f0fb2d5dab0bd3b9c3667cd55c7d2bc62e4e4d5c4bea5de92ed9d301a6b80cbf94c986717ff844f2b7e639021a2361dee56a1cf85c4af766366a6
SSDEEP

1536:iHCvF6hG6zAgrE5b2l6eRK8r/6GIfIuHSDdmvXoDfL9UZR0v3uoj8fMfFw:74hG6M+lZ3iGIgA/XAfmZ+v5j8fMfFw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2460	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1640	2460	3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe	30
PID 2460 wrote to memory of 1640	2460	3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe	30
PID 2460 wrote to memory of 1640	2460	3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe	30
PID 2460 wrote to memory of 1640	2460	3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c74e0a5adcf788cd53ef694413cc34e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 408
  2⤵
  - Program crash
  PID:1640

memory/2460-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download