7f91a180c453c12048cf712efa05de3b3d9e51398d2e731751c20c7c8afaa2e9

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 10:50

Target

3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe
Size

316KB
MD5

3d116d9f8126493834575788bd7273b6
SHA1

4afc1031fe7dd5f2f22eb91e59dca6d3ddea5547
SHA256

7f91a180c453c12048cf712efa05de3b3d9e51398d2e731751c20c7c8afaa2e9
SHA512

47d431a487c5c3000fc85a116389d7f7d7dc18a287076a3ef1ca2ac3e688cc19889a1abf53e459dd859062152b03f2205fb372e4930055494669624c578523ff
SSDEEP

6144:N8CAnesG0jEZWX8gh5Ife35qqy8BoNVwxS+Iv6rfE4ShXlrR:MneCEEX/5Ife35qq9BnxSfv6rfMXtR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	2224	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1612	2224	3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe	29
PID 2224 wrote to memory of 1612	2224	3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d116d9f8126493834575788bd7273b6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 184
  2⤵
  - Program crash
  PID:1612

memory/2224-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download