0777ff8f94062182d82611660bfc8579e7e01a3e10d94738abed4fd290ee5c56

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:32

Target

4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe
Size

358KB
MD5

4ae4d1f831b516d78b9ba83320fa3ec7
SHA1

3ecd534c13a8ccf27f9ae4ee9bc8a40b2ed92109
SHA256

0777ff8f94062182d82611660bfc8579e7e01a3e10d94738abed4fd290ee5c56
SHA512

f00c3d2004062fbc9590734c6685d8d9a24fae035940d823a3fd190433014c10be677eef490a48d0789bab44ce8f71c139b922e4c2849e911a7cbf29010e0299
SSDEEP

6144:jyFQr8PEEEoIpVZYB10TBIvuoEkGBepKx677iou4bZR2bPuZeN/Hy5bCrE:jrr8PEEE97g0TOvupvxIbXSuZehy13

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2672	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2760	2672	4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2760	2672	4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2760	2672	4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2760	2672	4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae4d1f831b516d78b9ba83320fa3ec7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 164
  2⤵
  - Program crash
  PID:2760

memory/2672-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download