a437df52db40502420965ce474b4fa01d3bd8e8d85206502da7229aa7f08a916

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 11:42

Target

418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe
Size

28KB
MD5

418659e9e1bf4540f5bcc8acf9f5106a
SHA1

85916652960bf52bea4abf13628eed619833cf70
SHA256

a437df52db40502420965ce474b4fa01d3bd8e8d85206502da7229aa7f08a916
SHA512

80afa983c9a05e22d40eb6d5e99489c24e3524d302b935a9c854b28da03574ad6d8754f6d1aa1278c9052cf3e75401e702a554d94ca18dc29b3e5b68977b8db0
SSDEEP

384:wOS5JlR+NEZos0Pe/08zA11zy4ViNKtWWDESXoTK7Vbnq78ZI/g6ibQ4/GGSU5Zn:I5eELAXy4A4t+wAK7Nni8ZITik8SS8E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2636	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2720	2636	418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2720	2636	418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2720	2636	418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe	30
PID 2636 wrote to memory of 2720	2636	418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\418659e9e1bf4540f5bcc8acf9f5106a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 88
  2⤵
  - Program crash
  PID:2720

memory/2636-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download