a026f6ed9b929151da0eabfdb9952232eb7e703e665a9deb1a37cba220aa4297

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 02:53

Target

e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe
Size

83KB
MD5

e90c58699e035f7870f2810883e6d2de
SHA1

d7ba4ce45b276ec99124b8440180c1fc4ef8555b
SHA256

a026f6ed9b929151da0eabfdb9952232eb7e703e665a9deb1a37cba220aa4297
SHA512

9f0b34dfb2bc7da84c4a894b7ac5a04bbafdf45b4d9fcd9b4389ee1a9844049b95acf5e21430e36987e9a11dfcd25f0b6f61d6e5932b5f9ecbb05b647d05d0b0
SSDEEP

1536:LP+4d19bQqlBnlG4wQCYz+D/TUARjyxruE/lAm+SUcfjKqy:LP3bLPlGUI/7eXSp2Fy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	1164	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1740	1164	e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe	28
PID 1164 wrote to memory of 1740	1164	e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe	28
PID 1164 wrote to memory of 1740	1164	e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe	28
PID 1164 wrote to memory of 1740	1164	e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e90c58699e035f7870f2810883e6d2de_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 120
  2⤵
  - Program crash
  PID:1740