b439bcc5db145023e2fa32e0c0a2963f945adfbd6ada1f7c936ce19448208e46

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:00

Target

605406def8d25e9f222aebc77c313962_JaffaCakes118.exe
Size

62KB
MD5

605406def8d25e9f222aebc77c313962
SHA1

9167fbf69b13a5ba0917ce46616838db30dcd84c
SHA256

b439bcc5db145023e2fa32e0c0a2963f945adfbd6ada1f7c936ce19448208e46
SHA512

436e2a417331ea477685ae85065e06e6422f2ae088e717ca05b12ccf994eef2338a04506befaf4b83ea8e73f7a7b5a750209eab5d69c7ad9834b93be19de03a8
SSDEEP

1536:aAl9XjOIdF3WHRv3P0tf1o8MJzA8sphS80676:aAlcMF3WJHJcpQ676

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	3032	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2756	3032	605406def8d25e9f222aebc77c313962_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2756	3032	605406def8d25e9f222aebc77c313962_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2756	3032	605406def8d25e9f222aebc77c313962_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2756	3032	605406def8d25e9f222aebc77c313962_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\605406def8d25e9f222aebc77c313962_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\605406def8d25e9f222aebc77c313962_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 36
  2⤵
  - Program crash
  PID:2756

memory/3032-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3032-1-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download