00370ac113c65b9b95a2a84b8cd2fdff4dc232eda024dc22837568e55f225d4b

Analysis

max time kernel
140s
max time network
22s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 23:44

Target

474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe
Size

120KB
MD5

474c3cf7720b07c9ccd071cf0fadbeee
SHA1

bc98d1efeba799ddb434e6cc99387804df6ce0ed
SHA256

00370ac113c65b9b95a2a84b8cd2fdff4dc232eda024dc22837568e55f225d4b
SHA512

fac23657634748a3a1860d18e1023ab0219729362d80e5e75f67b375293e4794a9dcc5572eb84bdf93a749f1163ac9a2db8864ec42edc637d2834f6b5a070d0f
SSDEEP

1536:2PFHG0UhkYZhyI9IIj4YJfjS4fC21WbNViCo5fhDoDezL89:2NvnivrSVjbNno8De8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1872	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2160	1872	474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2160	1872	474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2160	1872	474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe	30
PID 1872 wrote to memory of 2160	1872	474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\474c3cf7720b07c9ccd071cf0fadbeee_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 44
  2⤵
  - Program crash
  PID:2160

memory/1872-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download