ceca350b89187da95228e8cc2a801e0833f3442085e42e3016602027ae93e30b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 07:04

Target

3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe
Size

601KB
MD5

3c6866938e2119cb7f689d6ab20a8ac1
SHA1

9baa8ee24148018806b308372546943b073c6216
SHA256

ceca350b89187da95228e8cc2a801e0833f3442085e42e3016602027ae93e30b
SHA512

875239eb2c18846bb947e3a3ee1384675dfd79847b46417cc0c075cd827857ad5dbbbbdeec6bace334234d77358d5c55230e94fbc11fefd0f7f5ab5d5bdb8402
SSDEEP

12288:AipjWvV48O3rfx7HyRHn8R4+2f5aTNyVKFF:AOCyz7xin8y+C5aTXb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2924	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2936	2924	3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2936	2924	3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2936	2924	3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2936	2924	3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c6866938e2119cb7f689d6ab20a8ac1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 128
  2⤵
  - Program crash
  PID:2936

memory/2924-0-0x0000000001000000-0x000000000106C000-memory.dmp

Filesize
432KB

Download