d4979877d317ac3ee167239f647f6a55a821cfac7875528e3bbecb7110f2f60b

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 09:57

Target
494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe
Size 297KB
Sample240715-ly4dta1alm
SHA256 d4979877d317ac3ee167239f647f6a55a821cfac7875528e3bbecb7110f2f60b
MD5 494b4a4f6f9fc3d298619519417bac4a
SHA1 c1e1bda6a632ae178386b89da3a3d15d97ef9bca
SHA512 b81e78488654f27fb9c8725e4f0c1555eefabe8958a72dd36a90362689aebc990213f4aafc082baebe6f6683082aad0a7bac62365ca3854df36598db4e33f320
SSDEEP 6144:+O9jt6wZu8OGauB794zlvkuymdzXZIwaUPT3Pbkx:oQauB794zny3wpPbbkx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2056	WerFault.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29
PID 2056 wrote to memory of 3060	2056	494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 268
  2⤵
  - Program crash
  PID:3060

memory/2056-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2056-2-0x0000000000240000-0x0000000000283000-memory.dmp

Download

memory/2056-1-0x0000000000240000-0x0000000000283000-memory.dmp

Download