46596f6a8ba0eae56c13f4876ff1cb74c93f7cee30dd503a47087429fac1320c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 11:04

Target

4588f23494fe24b339f50476374551d1_JaffaCakes118.exe
Size

165KB
MD5

4588f23494fe24b339f50476374551d1
SHA1

427d6b4f73294613ab69009312fe8c2a61a6e4c8
SHA256

46596f6a8ba0eae56c13f4876ff1cb74c93f7cee30dd503a47087429fac1320c
SHA512

21bce946a4278ad28bb8a8139d2c2d79fbe20e85d1ba8aa8189e7925e978988f2cf966d8b693e87550a93c2bb73142327607530097706038c6159d5668bcb5ae
SSDEEP

3072:KFpQQDO+41YmbQyRPkADIRnrxSuyJ1gjuYUEHjE2YKHMq8gus0/KKRO:KDQ1VY7yScIRouWgi0LDZI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2692	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1740	2692	4588f23494fe24b339f50476374551d1_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1740	2692	4588f23494fe24b339f50476374551d1_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1740	2692	4588f23494fe24b339f50476374551d1_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1740	2692	4588f23494fe24b339f50476374551d1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4588f23494fe24b339f50476374551d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4588f23494fe24b339f50476374551d1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 152
  2⤵
  - Program crash
  PID:1740

memory/2692-0-0x0000000001000000-0x000000000102E000-memory.dmp

Filesize
184KB

Download