7e862a9800abbd9be934b35b8ba26d282b23ab630cfe3b2928e918e149b0f075

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 23:40

Target

43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe
Size

197KB
MD5

43b990403f632dd9ee1b0a1d84191595
SHA1

acbaae3798f8858ae2aff60e1f21b28da0b3c906
SHA256

7e862a9800abbd9be934b35b8ba26d282b23ab630cfe3b2928e918e149b0f075
SHA512

d511fcbd96119595a66b9fcf449371ef4fe617d81ecb13eb962a0a019e9232c6697b2876bab282cf916bff46f6163ef40998ebdc4d2f519a7ab202cec41f5d0e
SSDEEP

6144:NjayIHeHUpSri0dWRNMVb9V2M66LTBk61V:layqel5dSC2qLTya

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	828	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2472	828	43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe	30
PID 828 wrote to memory of 2472	828	43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe	30
PID 828 wrote to memory of 2472	828	43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe	30
PID 828 wrote to memory of 2472	828	43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43b990403f632dd9ee1b0a1d84191595_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 156
  2⤵
  - Program crash
  PID:2472

memory/828-0-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download