b39efec102bc11e8bcd06eb3c0f70c6dc4ac722ac7359c6a58cc93d25ce33bab

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 15:18

Target

4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe
Size

6KB
MD5

4662625854c85b32eb17b8392b91b0c6
SHA1

ea87e03a46088592a90d440f7ea572a76200ba95
SHA256

b39efec102bc11e8bcd06eb3c0f70c6dc4ac722ac7359c6a58cc93d25ce33bab
SHA512

431830e40471f9b157fbe13b72c8f637935c626be0a33ace30470168f0114fd762e2487939449373c4068652e5f65fec5eaf012abe7842e82cc9e1a1fe082315
SSDEEP

48:6a+k6R6CVce1VyB6ZUC5DSeO+sNeQ7US4QOo0nmP81M6GdHKxcwEj4xy0fAtk4Nw:x4ce35DSGsXUzQ/RUGxwEqy0fA2s7H7A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2976	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2628	2976	4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe	31
PID 2976 wrote to memory of 2628	2976	4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe	31
PID 2976 wrote to memory of 2628	2976	4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe	31
PID 2976 wrote to memory of 2628	2976	4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4662625854c85b32eb17b8392b91b0c6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 60
  2⤵
  - Program crash
  PID:2628

memory/2976-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download