39bccf265c8a2d2d9e3bd000cef94ddd204761cff6de4fac8f41ca6a399db7f8

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 12:01

Target

3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe
Size

32KB
MD5

3d4ca4a0371f08ac0c7a34a508f6c107
SHA1

cd586e6e6c98b4da7a8862679f4d371d83cb15ba
SHA256

39bccf265c8a2d2d9e3bd000cef94ddd204761cff6de4fac8f41ca6a399db7f8
SHA512

5ee571808bec533658ff3ae2b32c79177d3b3638cde2f0548db04bdbe3d7f405a9ac32fe698d33de22c1763dbc9ffb5bbf82eefb859efe876aabfadd9dc9c8b7
SSDEEP

768:23CbJmHF7RBKqhba4FwP/3SL+VdhU2t566h1S:23CbJsFCqhbsXiLmdasX1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	1820	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2504	1820	3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe	30
PID 1820 wrote to memory of 2504	1820	3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe	30
PID 1820 wrote to memory of 2504	1820	3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe	30
PID 1820 wrote to memory of 2504	1820	3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d4ca4a0371f08ac0c7a34a508f6c107_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 88
  2⤵
  - Program crash
  PID:2504

memory/1820-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download