af9c737d05ebc53b58d3f98d346c85ed133b6cd7f89cd17f755dfdbe85dabda5

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 17:00

Target

4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe
Size

199KB
MD5

4a95aff206d16afe6e165ee3566c51b9
SHA1

6608d5f9ad4a76e4a9b215d88eae80c2829cc5ce
SHA256

af9c737d05ebc53b58d3f98d346c85ed133b6cd7f89cd17f755dfdbe85dabda5
SHA512

08138775dcda8ea468808a438af070418629138e888aee769a9ab43828911910fa0660111f8aa4b9493ab382d0a5d14a4a7a9951328f3c0cf5e56d0f563c1545
SSDEEP

3072:jsWqIX1oQV8XVRUz1oQYnKuKC6fiNE8oTXP1o375y3EnBwhzrzZgIO1JOCyiFjl8:Q61RmRQej3F618or0JcfO1Uzw4b5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2372	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1708	2372	4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1708	2372	4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1708	2372	4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1708	2372	4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a95aff206d16afe6e165ee3566c51b9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 148
  2⤵
  - Program crash
  PID:1708

memory/2372-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download