b333fe6a0912cd2587778cf63a7bba3ed87bee677616fa568daba8db688e157f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 09:02

Target

ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe
Size

203KB
MD5

ed0d8dc175ca9fded902c1f72bf0b933
SHA1

a3497600e2153d7a4d57af519cda599b85705e21
SHA256

b333fe6a0912cd2587778cf63a7bba3ed87bee677616fa568daba8db688e157f
SHA512

411a0f80f33e2b3c7bc2e2c255058b988b00cf56f6fbce53fb75fd31cd3828488b13a3b09370412269db04ae194d859b43a829ebf29cd114ea3eda44ba984341
SSDEEP

6144:DuFLgte2hxTV6mzLFxUgjmf3+GyWhdqr/+/R:GUfXljmhnirm/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1648	1684	ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1648	1684	ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1648	1684	ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1648	1684	ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed0d8dc175ca9fded902c1f72bf0b933_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 68
  2⤵
  - Program crash
  PID:1648