36c4489b4448ec451c084d19ae10f0f6eebe7f56b40b976881abab88d8bf53ea

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 19:22

Target

3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe
Size

80KB
MD5

3e91aa581d8284682add81d828bc5d59
SHA1

fe551dc12387aaa6928b82cb2775e7f59b7026b9
SHA256

36c4489b4448ec451c084d19ae10f0f6eebe7f56b40b976881abab88d8bf53ea
SHA512

e8f49a3a34a4924b3a7ec6e071609c1e74c1123f5582a4d987372e572a2b332046fa0ee4d855fb17468b2d349cda827d2409f567f03cb6bbb0e1d9b65fe356fb
SSDEEP

1536:so15MzLpvuwjavf5UpLQCRvsm7SJt3A+tFn:F15MzlDa3lCRBS3AAR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2004	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2964	2004	3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2964	2004	3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2964	2004	3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2964	2004	3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e91aa581d8284682add81d828bc5d59_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 88
  2⤵
  - Program crash
  PID:2964

memory/2004-0-0x0000000044440000-0x0000000044458000-memory.dmp

Filesize
96KB

Download