47402e4a017278e12b599869294355293b38c4f6e367c0c461916f7dfcfa7b87

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 20:46

Target

64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe
Size

85KB
MD5

64bf7f4645dbbda9651d3e799b441f95
SHA1

ea812172ecce3df6f553295f9d55de285cbf2e90
SHA256

47402e4a017278e12b599869294355293b38c4f6e367c0c461916f7dfcfa7b87
SHA512

5bd27a3c2a435fc199acf1ce9e1f14d75aedbd1173535d0a978933b55c32b7ceac8df033a9b763a677a0c03114ab78a635735f158c508b4508e2e90c6cc03949
SSDEEP

1536:hWbKdE3IwVaw4wPMzpO9vzJiI8WigER061dtfn+lPDH9ANqMIzXiBzljzd0dVQ:hwKqV0wPMpO9d3jEjtf+x9UB0izzdUVQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2316	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2368	2316	64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2368	2316	64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2368	2316	64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2368	2316	64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64bf7f4645dbbda9651d3e799b441f95_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 36
  2⤵
  - Program crash
  PID:2368

memory/2316-0-0x0000000000400000-0x00000000004156AA-memory.dmp

Filesize
85KB

Download