f39fc326f44c105b3058199fb8730c300b060f0dd3770c79d2ce51365d20c8d1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 04:59

Target

404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe
Size

67KB
MD5

404b5373045080ff460e7d8f2868c0de
SHA1

33cd11213ad078bb07c1e313e484271ca0573284
SHA256

f39fc326f44c105b3058199fb8730c300b060f0dd3770c79d2ce51365d20c8d1
SHA512

c7e73e6267ee40a9434af0d600670fffc9e68c9aae045563b7c6b8d7a88c0516516670aa9c404318fcd135e21d830685adbf2c7c18696cfdad0c1583af25cf33
SSDEEP

1536:xFGQjNsLP13pH0XqdpC0ozlqE1vsKZK3z5v1BqntM+3:x8ui7z06dpC0dE1tMD5tonf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	780	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1808	780	404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe	31
PID 780 wrote to memory of 1808	780	404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe	31
PID 780 wrote to memory of 1808	780	404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe	31
PID 780 wrote to memory of 1808	780	404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\404b5373045080ff460e7d8f2868c0de_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 36
  2⤵
  - Program crash
  PID:1808

memory/780-0-0x0000000000330000-0x0000000000359000-memory.dmp

Filesize
164KB

Download