0e1a00b72e6b767bc1d7054d78d2f30d8c0232fe680c6ab6eeec4ff7e385668f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 00:11

Target

61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe
Size

4KB
MD5

61fe4b9f90e0fac4012a89077a4ce115
SHA1

3f7a7e26919de58d1365b4e24af6de69e8e24f99
SHA256

0e1a00b72e6b767bc1d7054d78d2f30d8c0232fe680c6ab6eeec4ff7e385668f
SHA512

dddb584506b405e89d461ae748957d22d02600c51498338c0e1d89085492009732a939d15c773e1674dde5a0b36fb32c1f8187fe863a012dd0ff22a62a01be99
SSDEEP

96:RG6BD582O6i8jyntTyyVV9tMdk8Zl+Taprk+R6So5h:pBdjO6i8udRV7tMd1Zl+T+rQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1992	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1716	1992	61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe	30
PID 1992 wrote to memory of 1716	1992	61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe	30
PID 1992 wrote to memory of 1716	1992	61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe	30
PID 1992 wrote to memory of 1716	1992	61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61fe4b9f90e0fac4012a89077a4ce115_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 152
  2⤵
  - Program crash
  PID:1716

memory/1992-0-0x0000000013140000-0x0000000013148000-memory.dmp

Filesize
32KB

Download