1fc780c4864c6b00e2bbabed30a67f5b4cca78fc42f39392e770c72d5b2031be

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 10:29

Target

3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
Size

127KB
MD5

3d02226b31f4f46e5685391c00f35ffc
SHA1

cf5a807f372da6ff3eb714eb7739af4def5c74b5
SHA256

1fc780c4864c6b00e2bbabed30a67f5b4cca78fc42f39392e770c72d5b2031be
SHA512

d2482dbd1095afa8402b54d2ab22dbebf9c8bd633b60bb056eb43df078d844e9eece32b84d9fe6c7c9de054c7a07cf87779cfc32e6bd13b50c59b9ee5d7089a9
SSDEEP

1536:+ChM13d5uA+QZw3D84SAqHdsJboytAhHArr/0nMC4Nt3NIO2NnToIfBO9Mja:w3e06I6JboHAX/0GZH2FTBfB7ja

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	2568	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2388	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	30
PID 2568 wrote to memory of 1628	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	31
PID 2568 wrote to memory of 1628	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	31
PID 2568 wrote to memory of 1628	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	31
PID 2568 wrote to memory of 1628	2568	3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\B155.tmp" "8A'. ':':?'7'/'HKIIIMHJOOMNMCNHBJKKHN$18JJCU"
  2⤵
  PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 92
  2⤵
  - Program crash
  PID:1628

memory/2568-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download