a9399b3cf84abff8763b383e0ca211e8c18aa907c509ae6c4a56a7452e2a9edb

Analysis

max time kernel
23s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 05:50

Target

44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe
Size

15KB
MD5

44906bbd4ccace8a82c4efa65882b130
SHA1

0d896a9ee490196f33d51f7619a82c8a4d6b950e
SHA256

a9399b3cf84abff8763b383e0ca211e8c18aa907c509ae6c4a56a7452e2a9edb
SHA512

1f3222115ae5b890d63357136d0a807a4895e0336baf76a3577a2ebcbba1bb6a94c33fa7967097215cf3e80d12125ec6ecf0d348a2faa30354438d43ed296b10
SSDEEP

384:q3m02vDqiBD6sqy6i1j8LvRXldrD9D3HLMIbgbRB6:mx2OiFxBxedzpDgAgU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	2152	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1100	2152	44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe	29
PID 2152 wrote to memory of 1100	2152	44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe	29
PID 2152 wrote to memory of 1100	2152	44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe	29
PID 2152 wrote to memory of 1100	2152	44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44906bbd4ccace8a82c4efa65882b130_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 120
  2⤵
  - Program crash
  PID:1100

memory/2152-0-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download
memory/2152-1-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download