85abf69154d4b77e18b151b6b47f732066d58ab5c05226cfb395869f1fa30135

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 17:44

Target

3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe
Size

20KB
MD5

3e47fa43d6a3bbe88976779b8ae522a2
SHA1

7a7a015087546e3298499a7d945c0a5a3791e4bd
SHA256

85abf69154d4b77e18b151b6b47f732066d58ab5c05226cfb395869f1fa30135
SHA512

4498748c5bcb61ff683a96eac6446e5bfa3c36f273202f9a243ea5990849856bdd599373faa0407862ea1007c71f070c0fed10be969742d1d314525b5018372e
SSDEEP

384:/MvLoRjjmIqLE9A7XYjCFbgabgkMEWWRoJV8ljBVw68jIO8N:UvLoj1qLE9SYjCFbrpW4oOD8k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	1924	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2140	1924	3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2140	1924	3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2140	1924	3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2140	1924	3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e47fa43d6a3bbe88976779b8ae522a2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 88
  2⤵
  - Program crash
  PID:2140

memory/1924-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download