2e709add8ee3758d4c01881450e690c76087fb6d8e796e56c0fc38044be0e8b3

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 13:50

Target

636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe
Size

32KB
MD5

636ae6d3335f38b4ab6cdb436966f965
SHA1

946ad838e802385fc5d652c7ad6b21ab293fd92a
SHA256

2e709add8ee3758d4c01881450e690c76087fb6d8e796e56c0fc38044be0e8b3
SHA512

f0fcb3f48a42037a48a6cb51486039e660aa5e04b34e83a8c619b4d826717e4719f5f77883697fb1e5552d36bb81e17e5d2832d73e6a42ece17bc42aa53cb62d
SSDEEP

768:EsYSoNHBLcg043SA4XvEM1kdwrkliySXZl6gbnyuYkITZ:lXoPL643SPc9wwAhXZxniPF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2180	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3040	2180	636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe	30
PID 2180 wrote to memory of 3040	2180	636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe	30
PID 2180 wrote to memory of 3040	2180	636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe	30
PID 2180 wrote to memory of 3040	2180	636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\636ae6d3335f38b4ab6cdb436966f965_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 88
  2⤵
  - Program crash
  PID:3040

memory/2180-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download