a5fff3447b4350749062f39750818d713c716678dc7fd7a83c13b40420302317

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:32

Target

4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe
Size

114KB
MD5

4ae4319d28dc19067004aaacbdfe67bc
SHA1

6abd48ddc6cd1ef87d8934ab812417c1d352257e
SHA256

a5fff3447b4350749062f39750818d713c716678dc7fd7a83c13b40420302317
SHA512

9ce18ecd8a084a1869f7cb8aa728aa04122dfb0272fd8a6446dc962e1dd2c35d018a97dfe7ce09f383d9d1fb4a282d8a1e56721d1457166a454ddda1359d8146
SSDEEP

3072:jnpsQgSBPbgVqUfZyKubTfZqVKmAhw/KvD27Oi:NhgSpgVqUBIbYVK1S17Oi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2672	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2796	2672	4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2796	2672	4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2796	2672	4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2796	2672	4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae4319d28dc19067004aaacbdfe67bc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 36
  2⤵
  - Program crash
  PID:2796

memory/2672-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-1-0x0000000000405000-0x000000000040A000-memory.dmp

Filesize
20KB

Download
memory/2672-2-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download