a8522faf452141334e31a7f4723fe5d81d2b2e594f3df318560142f1d9ed4d22

Analysis

max time kernel
24s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 12:20

Target

3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe
Size

4KB
MD5

3d5a2f839a432d612a8c70624d400627
SHA1

bc729e2ae5834230ad5b682350e8d224be19fd82
SHA256

a8522faf452141334e31a7f4723fe5d81d2b2e594f3df318560142f1d9ed4d22
SHA512

d59b08b2606f1766cfef549340c4095e502570fa709879100fd4dc92b551e931f5d2563d886d25d84a0850bb9b3cc3fec382b83dddb882f59af1cfffbab6ba00
SSDEEP

48:6davu3tlf/3hFgtSGuJ9eDXBfyQiHxWDlRi3FWSfbNtm:43n/xFmfDXBfyFGTSzNt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	3012	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2164	3012	3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2164	3012	3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2164	3012	3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2164	3012	3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d5a2f839a432d612a8c70624d400627_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 544
  2⤵
  - Program crash
  PID:2164

memory/3012-0-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/3012-2-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download