5896bf334021fb3302a18f40a8ac3e9489ba2b753b9ebb2af93c7d05d91bde66

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:27

Target

46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe
Size

259KB
MD5

46cdc44d9b6fe11f2669577d4df124ce
SHA1

3ae1c6b1e70b8589a9b3151b9e97e3aee503cba5
SHA256

5896bf334021fb3302a18f40a8ac3e9489ba2b753b9ebb2af93c7d05d91bde66
SHA512

1847647302f582ef771f80adead5b911384704a18d70b2513199500a2b7b907f3279ef33346ae01f43074eede07ce9f9e2ae8dfd62097ebf0cff120fe2412d4a
SSDEEP

6144:WWvEcQuUXlu0vShhJNjOL1x6pZLM2JA9RAe4ayc4EYVuO4nehiJ70:3jM1SDgYp6D4ayc5eoV0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2176	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2860	2176	46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2860	2176	46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2860	2176	46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2860	2176	46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46cdc44d9b6fe11f2669577d4df124ce_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 64
  2⤵
  - Program crash
  PID:2860

memory/2176-0-0x0000000000400000-0x0000000000428200-memory.dmp

Filesize
160KB

Download