ea5e530dc8c5f974be7186c1a974b911c79ecc15a125fc538e5a11b98076aecf

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 03:13

Target

65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe
Size

31KB
MD5

65ea8a00278a397ad1f6825b4d49da95
SHA1

e6c5be50de8507a957c9c3f96708e004bea01c63
SHA256

ea5e530dc8c5f974be7186c1a974b911c79ecc15a125fc538e5a11b98076aecf
SHA512

e589c2faafa89886053bcf3b3976afcb298fad865723e1599ec04aafbea1fccedc132c1cac02d188f92ff8e4de33cf699a470b02e500fca3bfc566777ff4e322
SSDEEP

768:Z6h7TzTBziifTeiZSVWihwEEnh0L7uTLeNfQfBOp/:gZ/nEEh8uTKNB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2304	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1696	2304	65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65ea8a00278a397ad1f6825b4d49da95_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 88
  2⤵
  - Program crash
  PID:1696

memory/2304-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download