8718c5633bead4dc385fecb6d00b37adb02297425a86dd06525e7dd3755721f2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:13

Target

4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe
Size

188KB
MD5

4bd3217d91a12d3be5349bd885405db9
SHA1

9c5c23f044c9f393f4f17e3fcbf5863e0f6c2801
SHA256

8718c5633bead4dc385fecb6d00b37adb02297425a86dd06525e7dd3755721f2
SHA512

c0a03680e43193618651029f258d16c8946302dc6a973c44f2744f1780611c05545c61b6943152cafe7818c02f9d9c87268260c38f925c41c04c8e9937031a95
SSDEEP

3072:524WFT68R+PnPbJvyO55dtuJ8sCTp1o2b3iKmpWNBXJKEAH1IKr2knADevZCPTrC:bWu8RaPbgOrQApm2cWNBXqVIa2k8evZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1984	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe
1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2224	1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2224	1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2224	1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe	30
PID 1984 wrote to memory of 2224	1984	4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bd3217d91a12d3be5349bd885405db9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 44
  2⤵
  - Program crash
  PID:2224

memory/1984-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download