26140e2ab38e1a9f0bad1244e53072c4c04b935b22c537cfb3cdd2d08ebd8a04

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:52

Target

4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe
Size

181KB
MD5

4cb4154b95725ef65edfbad3cc791780
SHA1

e2297472e395ba9dad4cbee5cf2f81fa5fbc3118
SHA256

26140e2ab38e1a9f0bad1244e53072c4c04b935b22c537cfb3cdd2d08ebd8a04
SHA512

a39e6828c2ac23784d40f4f7e9d8c6f70c3be32f953ba92d20a4218030d9d2147f52809b41ac5bacc3c46d0b52411326319e36c5d4f84ccc94593f4cf11a1a77
SSDEEP

3072:+7p+wVPJFGc5clfnifqr/BZuUPW2yTLCcGEJ+idsqjngeNlpEvk4R/qeBCYK72FT:+7cOPJwcSlfiy/BsmPOuN8sqJbG3Fqeg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1916	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1300	1916	4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe	30
PID 1916 wrote to memory of 1300	1916	4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe	30
PID 1916 wrote to memory of 1300	1916	4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe	30
PID 1916 wrote to memory of 1300	1916	4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cb4154b95725ef65edfbad3cc791780_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 36
  2⤵
  - Program crash
  PID:1300

memory/1916-1-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1916-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1916-3-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1916-2-0x00000000004CC000-0x00000000004F8000-memory.dmp

Filesize
176KB

Download
memory/1916-6-0x00000000004CC000-0x00000000004F8000-memory.dmp

Filesize
176KB

Download