a04ca2d7c4b90d040fc95f3248e85b7f0d00b2b1bc1f304de5c300f23fe30c12

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 16:33

Target

4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe
Size

156KB
MD5

4a7fba52a9dc7017abf5a2962ea95fb1
SHA1

885e47fb2928a2a48e22e0d3c6d951b1c0193ef2
SHA256

a04ca2d7c4b90d040fc95f3248e85b7f0d00b2b1bc1f304de5c300f23fe30c12
SHA512

dd69526421abd7d4bd3c3c12675e1a257ed2a9c10c5e73db437c7d38751eaef85fff6ed9dc326c0b3707710e49bd8ff40d4c17eb034bc137ff9b41c2b0f371cf
SSDEEP

3072:+wenTS2y56gbralb4FFEt/7V1x+kH+Cs9ujiKgXUFL6:+1nby5Slb4Hm7V1p+Cs9uPg26

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2744	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2816	2744	4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2816	2744	4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2816	2744	4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2816	2744	4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a7fba52a9dc7017abf5a2962ea95fb1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 88
  2⤵
  - Program crash
  PID:2816

memory/2744-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download