d3ac61ea5b337fe8198ea87d8723e593cda0188524ecfe5d66a66978d5440f04

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 08:27

Target

66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe
Size

273KB
MD5

66d2d755613cfb0e705322d14e6e5f62
SHA1

06f1593947a3fb1be50e7496a44c1e7cae5c0749
SHA256

d3ac61ea5b337fe8198ea87d8723e593cda0188524ecfe5d66a66978d5440f04
SHA512

e2941c9d483821c319c3478530ec3b023670dd6d70a212f1106c6c336491dd5f7d677ed3c84de9ca2b81dd00dd54682e9f948fbe61ce84dc4989d8de9043a224
SSDEEP

6144:Bd6xaiyB5L0hj5i5uDpfMMMMMM2b+qylbQ+RmaoVLgn:LiyzYx80MMMMMM2yqheki

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2736	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2788	2736	66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2788	2736	66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2788	2736	66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2788	2736	66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66d2d755613cfb0e705322d14e6e5f62_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 36
  2⤵
  - Program crash
  PID:2788

memory/2736-0-0x0000000013140000-0x000000001318D4E7-memory.dmp

Filesize
309KB

Download