4f644d6724d32b1f3e2e9ec8a1cfd9a53a352f2d4d436d4bbf7f689f73559291

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:12

Target

5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe
Size

56KB
MD5

5d7f508e5a637399214d4f4da8e61828
SHA1

815dca5dafbdf1bac21c3fecb0f107674c3c0f64
SHA256

4f644d6724d32b1f3e2e9ec8a1cfd9a53a352f2d4d436d4bbf7f689f73559291
SHA512

8d6a512c72b40302f729cc6efb970ee95142ab7ed631bb94475aaa49454c08ec7012d649e1709e10ce556a44c783548229768da1fbbdc1b23aaa307cc09ff710
SSDEEP

768:N9txDD3sgTeBsK26R0FXpl079p28MUqn2yHEM0S6H:3X3pTIs7Zc32TN2yHa7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	3016	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2120	3016	5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2120	3016	5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2120	3016	5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2120	3016	5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d7f508e5a637399214d4f4da8e61828_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 36
  2⤵
  - Program crash
  PID:2120

memory/3016-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download