4d5c9e5962c15f7fb986bf9be928ffd0d358ffef2698a482e34a334c15a9a1a7

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 06:46

Target

44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe
Size

33KB
MD5

44bdac1fc20c2ea36b70e36a92cb2edc
SHA1

08778632dbf6f3bf5d1026b99c326daa19460b29
SHA256

4d5c9e5962c15f7fb986bf9be928ffd0d358ffef2698a482e34a334c15a9a1a7
SHA512

25878b8542e729170dc316d742eebeb3d40e34b1ba0ff90fa72c9a538bea2e1e865ecb3289a9033904fda157a596fd7384397181908696fdd108c8fd85ac938e
SSDEEP

768:iOhr7n7ImfHd5Q5dYEd908u/aiV0VoOZ6wiF:iOhrb0sceEz0jiw0W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2160	2364	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2160	2364	44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2160	2364	44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2160	2364	44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2160	2364	44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44bdac1fc20c2ea36b70e36a92cb2edc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 116
  2⤵
  - Program crash
  PID:2160

memory/2364-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2364-1-0x0000000000405000-0x0000000000406000-memory.dmp

Filesize
4KB

Download
memory/2364-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download