cea7c4c8e08cae0898566bbc7d618efa6710e5d283d6582ae47bdbfaab50bd5e

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:27

Target

4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe
Size

46KB
MD5

4c9eed823986d16058238f7ea6068527
SHA1

4ec5cb2a99fd44dad51e414f4b3ff908d44ddcef
SHA256

cea7c4c8e08cae0898566bbc7d618efa6710e5d283d6582ae47bdbfaab50bd5e
SHA512

c3ab0111480823410c64916c696dd81c13240d16f981afa81725431ba8926ae008792336bfbde6936f682e399850356708bba2410738c846f6b4889c4b8307c9
SSDEEP

768:Dqf9jIUPn02V8enWJbEzFPd42jy69D69IsWFQ993irRW:DoIUPK5bwPy2jyaO99y8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	1908	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1916	1908	4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe	31
PID 1908 wrote to memory of 1916	1908	4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe	31
PID 1908 wrote to memory of 1916	1908	4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe	31
PID 1908 wrote to memory of 1916	1908	4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c9eed823986d16058238f7ea6068527_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 152
  2⤵
  - Program crash
  PID:1916

memory/1908-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1908-1-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1908-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download