e0c44b66000734acac7f7a73aa00167c3e16cccf8cff57df0a4a0e67ca13ed8c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 09:45

Target

62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe
Size

87KB
MD5

62bba7e02be61ddfec9a29c7e973cec7
SHA1

b83360dc142d529599c4e42edcfdc3f7d4452b16
SHA256

e0c44b66000734acac7f7a73aa00167c3e16cccf8cff57df0a4a0e67ca13ed8c
SHA512

9f3eae61fa9847020be092cffb4f3d0010db256dc6c0a46966e2108269d9ae2b58add82c4337f2a1926095735fdac131763dbc95a37e0729c8c6bba08be2c822
SSDEEP

1536:OF+6ASdh0+qYikffbPqk//tZB8EwE9Ysk2u6a3d5IhLNXg7Vmm7gSZ/oMZBK:CN4+nl3bPqknviGr46AXqLNXg7VV7gGO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	3028	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3040	3028	62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3040	3028	62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3040	3028	62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3040	3028	62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62bba7e02be61ddfec9a29c7e973cec7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 36
  2⤵
  - Program crash
  PID:3040

memory/3028-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download