e36ad60e435b2891e4f92c40c0b4248e4e33e0090ea5f083393bf7dddbf80202

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 11:45

Target

3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe
Size

23KB
MD5

3d3d99cba06e0d103a9e35de581661e8
SHA1

060e76c138124801c01cf00b0e224f0df4bea50d
SHA256

e36ad60e435b2891e4f92c40c0b4248e4e33e0090ea5f083393bf7dddbf80202
SHA512

5cb7e2b30bb385cd75bfc2be1640e1fa67b35179a2be59c12e6e6ce29bfb9271bc5ff1908aff4154e35b9e9d2e123cff1e37d2cbd6bd1a6af4c80ebcd6bcecab
SSDEEP

384:Tw1XZfWxV1qF5EdBJhJfx/Gm7tbfuPHUjnYjV/diW5H7TlFZnUpJvlj4Sc3PldAV:s1XZfWxV1qF5EbJhJfpRbfuPHUjnYjV+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2460	WerFault.exe	30

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2752	2460	3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d3d99cba06e0d103a9e35de581661e8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 252
  2⤵
  - Program crash
  PID:2752

memory/2460-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download