6dc33fc2b701809659bfa6a4a7227860acdba9c0fe44f316e06b4cfd2169890c

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:18

Target

4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe
Size

422KB
MD5

4e13b8f217e0d85a7a662ec319fee9ea
SHA1

d2ea40739ea4a7d42480553e09dd43e81a2e5448
SHA256

6dc33fc2b701809659bfa6a4a7227860acdba9c0fe44f316e06b4cfd2169890c
SHA512

481248ecb6eef3d50d9772e4a74280ef938a7536e464bac705b71db3f7c7cf9a59610a05cb9b3c1e58328b2a2c2f903e372b1153acb4fd9b0e0ac543308975a9
SSDEEP

12288:cNvPQVVqAm5n3n3/hIkcH6DD5XWijxSTDEDZ69p2tTbB30gsWdoZ:cNvPQVxm5nbDMijxSTADZCuHB7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2184	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2196	2184	4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2196	2184	4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2196	2184	4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2196	2184	4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e13b8f217e0d85a7a662ec319fee9ea_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 64
  2⤵
  - Program crash
  PID:2196

memory/2184-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download