c24e871268ff59f7820acf460b7b87d038415526c67bfbe8be75d0ea01958227

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 06:01

Target

4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe
Size

58KB
MD5

4885b70e1196f2b3c5027d3164adfd6c
SHA1

827bea49235cf6fe1ea44579ae73ab24e849b4f4
SHA256

c24e871268ff59f7820acf460b7b87d038415526c67bfbe8be75d0ea01958227
SHA512

81c36a727c96b412f375f259e79b80e18969bd8cf1d5f3e3a5a46976d9b8ddf830f57197d597f1ed47794514103dc355d33ccf3e01c4491ddee7e06fd9ed38e2
SSDEEP

1536:dy915ADfxpl0xEyfM43RO8/d41uzLTVqOO8RMj4:8915ADh0RMARn/douz/0Uc4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	2416	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1784	2416	4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe	30
PID 2416 wrote to memory of 1784	2416	4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe	30
PID 2416 wrote to memory of 1784	2416	4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe	30
PID 2416 wrote to memory of 1784	2416	4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4885b70e1196f2b3c5027d3164adfd6c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 140
  2⤵
  - Program crash
  PID:1784

memory/2416-0-0x0000000000220000-0x00000000002A3000-memory.dmp

Filesize
524KB

Download