660bc8d8af1929fd6f245e5088b3dab4a4819941ca40ebab1b0f57cd60b289ef

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:49

Target

46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe
Size

28KB
MD5

46dedc9ae33b78423b1119991d9ab479
SHA1

f6e736aceafafab092b7c1877b4360460b7126d6
SHA256

660bc8d8af1929fd6f245e5088b3dab4a4819941ca40ebab1b0f57cd60b289ef
SHA512

ccaaf6f73158ccd9c79f60217e533f8f4566a435c52b077027c0f47a3e229307baf4e54c35cfb0b3a54854b928f8ac9f248267ae9dfe54ee169eac351ae8148c
SSDEEP

768:/r41Krn5EQJIA1c/Rmq4PAbAiK5Jg43qpEEcl8ewU+W:/3yA1WuPFiK5JL3qpEEclxwzW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	468	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2336	468	46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe	31
PID 468 wrote to memory of 2336	468	46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe	31
PID 468 wrote to memory of 2336	468	46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe	31
PID 468 wrote to memory of 2336	468	46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46dedc9ae33b78423b1119991d9ab479_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 88
  2⤵
  - Program crash
  PID:2336

memory/468-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download