0ce76c4f570501039a68b7daa764b1dcee5dc5300af895c7e2f8cb48a41baff6

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 02:11

Target

43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe
Size

182KB
MD5

43e1f307c7c72b817e279ec6d2ad333d
SHA1

4f035fe62fe0c91df22f71c583c83dbd3f4f499e
SHA256

0ce76c4f570501039a68b7daa764b1dcee5dc5300af895c7e2f8cb48a41baff6
SHA512

6bcb363b2d4d3e2a52788949bd9a8dee4f9a311f516211c3f9cf5843dc48d3bc629f2188032fa2d8056ac91a89a6b482c13f247fb356069c6240a7169b33eb5f
SSDEEP

3072:8YJ8zrmpljBNUdh+nLEI9t/bpuM/l0/BTxzV9SrQq4CW6j2pVgv7mw4XeOv3x7qy:8YSz6H1YQnDt/b0Md0/XkQq4CWzDgv7P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	1316	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2484	1316	43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2484	1316	43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2484	1316	43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe	31
PID 1316 wrote to memory of 2484	1316	43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43e1f307c7c72b817e279ec6d2ad333d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 88
  2⤵
  - Program crash
  PID:2484

memory/1316-0-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1316-3-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1316-2-0x00000000004CC000-0x00000000004F7000-memory.dmp

Filesize
172KB

Download
memory/1316-1-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download