a7cfc5874b7f0d4400072a8e93cb88ebc77e96ad3ba5fae5411e193f066135fe

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 07:04

Target

40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe
Size

135KB
MD5

40a93ad02134fbff4ac9a7cdb2d40d33
SHA1

9e54456ff09764802292ddd299a42582682a6cc1
SHA256

a7cfc5874b7f0d4400072a8e93cb88ebc77e96ad3ba5fae5411e193f066135fe
SHA512

bb536ee4ef2b0075765061d96456a777d3329c485ed27627c2dd167b1c10bb9ea58d676c5e3a6fea6e4399573b1756490886278f84d8d6ede31ec9ee89130c90
SSDEEP

3072:dP9XmYClU9FgQma9o9x8CslwO46GptO7wiYn4baFNln:FZmyPJm4o8C4wH6GpevI3N5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	2988	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1788	2988	40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1788	2988	40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1788	2988	40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe	30
PID 2988 wrote to memory of 1788	2988	40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40a93ad02134fbff4ac9a7cdb2d40d33_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 96
  2⤵
  - Program crash
  PID:1788

memory/2988-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download