331344e393c96563fbbaac67087981a948ef8f19ce79debd27b2aed5630f44b1

Analysis

max time kernel
142s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:08

Target

48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe
Size

65KB
MD5

48bdbe25bebfa1962c3cd002d9fc27bd
SHA1

7d4761e46efbb0a2fc980d3de6a7aaef23c954cc
SHA256

331344e393c96563fbbaac67087981a948ef8f19ce79debd27b2aed5630f44b1
SHA512

fee8c9b9169a31517df50d593e8dc9c687c8bc099b7554ba3726cdc54fc1a17f7d175701b820ab8eca4f1d85c1b1945685f858dc89b7b943d01799e3154253c2
SSDEEP

1536:D/PVLPV7XEaJulcl6V33BiOzRWvPVJPVyAwkc:DXVLV4asztcoRqV5VfF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	2432	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1052	2432	48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe	29
PID 2432 wrote to memory of 1052	2432	48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe	29
PID 2432 wrote to memory of 1052	2432	48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe	29
PID 2432 wrote to memory of 1052	2432	48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48bdbe25bebfa1962c3cd002d9fc27bd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 44
  2⤵
  - Program crash
  PID:1052

memory/2432-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download