176efeb64d6da69d24af5fdbd396ae815a3467c1011cde1ec8871927ef25fdb7

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 20:22

Target

43349873d2226d6c83871137e0e15765_JaffaCakes118.exe
Size

322KB
MD5

43349873d2226d6c83871137e0e15765
SHA1

467437a5a66f5fb9c2edd559dfa01d851e208711
SHA256

176efeb64d6da69d24af5fdbd396ae815a3467c1011cde1ec8871927ef25fdb7
SHA512

461a67ccad58287ad6df735b98c6d740b1952bc6206ab4ac5ab5eec27f1426dd52d4416eac45cf5392f7b61a5c15326fbd19bfc5a40c324df7338db0e00edc6a
SSDEEP

6144:ZIJiarjhWxAkMRpPGXITOYFpc+uyIneuFUJVlslcq+rjGtUO:hA9DP1OV+uYuF4y6q8mU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	2084	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1628	2084	43349873d2226d6c83871137e0e15765_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1628	2084	43349873d2226d6c83871137e0e15765_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1628	2084	43349873d2226d6c83871137e0e15765_JaffaCakes118.exe	30
PID 2084 wrote to memory of 1628	2084	43349873d2226d6c83871137e0e15765_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\43349873d2226d6c83871137e0e15765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43349873d2226d6c83871137e0e15765_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 88
  2⤵
  - Program crash
  PID:1628

memory/2084-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download