5c121757cdfb86f7cee1f76930ef9fafbe4289d4a4fc56933190e2cf3c8afffb

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 02:38

Target

3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe
Size

471KB
MD5

3fdbc42b75dec4b235943687f0d5d1d5
SHA1

d7e96e6513c6660fd7e6be99e9935566b81a1278
SHA256

5c121757cdfb86f7cee1f76930ef9fafbe4289d4a4fc56933190e2cf3c8afffb
SHA512

f3c47bb5b57fa551da1fc6ffba5ad2550b958d768aaff2f3491c8e0b604ea175610275ee3d0260724063879ed2da037a318a1dac0f845a04bed4a7dbe9279fe5
SSDEEP

12288:WqSfQyUbB+tK4Sj0syol5uIC9Wtu6PZf3bWDIFCeE8zNx:WF3UbYSjn3l5uIY6FboZENx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2476	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2280	2476	3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2280	2476	3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2280	2476	3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2280	2476	3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fdbc42b75dec4b235943687f0d5d1d5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 120
  2⤵
  - Program crash
  PID:2280

memory/2476-0-0x0000000053140000-0x00000000531BD000-memory.dmp

Filesize
500KB

Download
memory/2476-1-0x0000000053140000-0x00000000531BD000-memory.dmp

Filesize
500KB

Download