8f225eb7d47958cf8db3883fb496f75a87edf436ba72f644d2f5fb6079f8a219

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 02:21

Target

65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe
Size

2.7MB
MD5

65c5c1d9d664e9b413da878bb596721b
SHA1

6ea4a7a32b9817786464fee8ce86f0147b07c8f4
SHA256

8f225eb7d47958cf8db3883fb496f75a87edf436ba72f644d2f5fb6079f8a219
SHA512

75cf718824438c716a0a2fb4c9917a5597dbcfcca4b4dd9b3261b1c03fe992ae0ec1d63e89dfb6fb3e4222336278b03f42082032ea840c83585f8e8d3d0e35ea
SSDEEP

49152:/SrT8MKIeIADvRZyVMgWTslViOLX1CUOpfENcbEU6RHHl2VnsHlwj7qaW4G:K0MKEkvOMgWTCVZZd+EN6cHFm+wjGaWD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2072	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1932	2072	65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe	31
PID 2072 wrote to memory of 1932	2072	65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe	31
PID 2072 wrote to memory of 1932	2072	65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe	31
PID 2072 wrote to memory of 1932	2072	65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65c5c1d9d664e9b413da878bb596721b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 140
  2⤵
  - Program crash
  PID:1932

memory/2072-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download