7ab81ebe2aa668148871221fe5d1fa597a4b390aa2d555fc0404cf40b58a9999

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 12:29

Target

41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe
Size

597KB
MD5

41a9fefa5bef69e83b5527b453ed14aa
SHA1

78d1120704f6b84b39cc54686c3d9c948176276c
SHA256

7ab81ebe2aa668148871221fe5d1fa597a4b390aa2d555fc0404cf40b58a9999
SHA512

789773010cf3885d030e9af9d75952848284c4f6c43ffc98712327c4b2479149acfe43cab163afd3df7b6bf1e914b484e0ec4708877f025152fd8de2c1e94f7b
SSDEEP

12288:9UtNL8YcLuYHaI7XHgZQKhJgeCmdxyYvbKtnacHSDljlUZI:abL8LHFLHgZpJEdscyDxlUZI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2336	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2208	2336	41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2208	2336	41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2208	2336	41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2208	2336	41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41a9fefa5bef69e83b5527b453ed14aa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 156
  2⤵
  - Program crash
  PID:2208

memory/2336-0-0x000000002F8D0000-0x000000002F940000-memory.dmp

Filesize
448KB

Download