f2449d2cd446f980b22f217650ad82cd3cc7c4a2cbd7e28ff6dd4c885f4bac92

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 03:33

Target

400724530137f044558a7837da689299_JaffaCakes118.exe
Size

31KB
MD5

400724530137f044558a7837da689299
SHA1

2f58aa55da1d43be9781cbb590981b8de0e0b60b
SHA256

f2449d2cd446f980b22f217650ad82cd3cc7c4a2cbd7e28ff6dd4c885f4bac92
SHA512

24b7a5de9f95b5172871379ba8c97d6c665d7be8ca340957bfbb2ebfd568709aa5517a43740664caa620090619b338601005ef0d7704a17452584267c394a501
SSDEEP

768:zIcfXOhlKoLxtCt74y/842kGim5admgS0CX0Ml:nCKoLD+h/84UimkdxMl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2384	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2536	2384	400724530137f044558a7837da689299_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2536	2384	400724530137f044558a7837da689299_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2536	2384	400724530137f044558a7837da689299_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2536	2384	400724530137f044558a7837da689299_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\400724530137f044558a7837da689299_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\400724530137f044558a7837da689299_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 124
  2⤵
  - Program crash
  PID:2536

memory/2384-0-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2384-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download